Is it proper/safe to remove dns role from a demoted DC server?

Hi,

I have demoted a number of DC's recently and I see that DNS server role is still installed on all of them. Also I see in the reverse lookup zones that all the old Name server records are still there. My dns is integrated with AD.

1. Once I demote the old DC, can remove dns server role from that machine safely?  I dont want zones disappearing or anything of that nature.  

2. Do I have to manually delete all old name server records?
rivkamakAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MaheshArchitectCommented:
You simply uninstall DNS server role from server, it will remove everything from that server related to DNS

When you decommission DC server, demoted DC must be automatically removed from ad integrated zone

what reverse zones you are viewing are must be non ad integrated zones (standard primary reverse zones) and hence they are still there as demoting DC won't remove them

Just ensure if your other DC's have those reverse lookup zones as AD integrated DNS zones
MaheshArchitectCommented:
ADDS and DNS role won't automatically get removed when you demote DC

You have to manually remove those roles

Any standard primary forward / reverse lookup zones exists on DC won't get removed when you demote DC, DC demotion only remove AD integrated DNS zones from that server

hence simply uninstall ADDS and DNS server role from decommissioned server
rivkamakAuthor Commented:
Thank you Mahesh.

I took a look at the reverse zone and it shows that they are ad integrated.
reverse-zone.PNG
5 Ways Acronis Skyrockets Your Data Protection

Risks to data security are risks to business continuity. Businesses need to know what these risks look like – and where they can turn for help.
Check our newest E-Book and learn how you can differentiate your data protection business with advanced cloud solutions Acronis delivers

MaheshArchitectCommented:
Then Are you sure that active directory is decommissioned from server?

Check if DC object is still available in domain controllers OU etc or if netlogon and Sysvol shares are still available on DC

If you are sure DC is decommissioned, simply decommissioned DNS role along with ADDS role and you should be fine

After that from other healthy DC, check and ensure you remove decommission DC entries if any from NS record / SRV records etc under domain.com zone and _msdcs.domain.com zone
rivkamakAuthor Commented:
Yes. Its for sure decommissioned. When I demote and it asks if I want to delete dns delegations I have been answering no. Would that be the reason?

If you could please clarify for me about dns, since I am using AD integrated zones, that means that dns is stored in AD, so as long as I dont delete the last domain controller in my network then I dont have to worry about disappearing zones. Is that true? As opposed to primary zones which I would have to worry about location of dns server?
MaheshArchitectCommented:
when you said delete dns delegation, it will simply remove server entry from dns (_msdcs.domain.com there is CNAME entry)

In case it is child domain DC if you are demoting, deleting delegation will ask you to provide credentials of root domain as _msdcs.domain.com is owned by root domain and removing entry from it need admin rights

Don't remove anything on zone level before you demote DC that is all I can say, because any modification in zone will replicate to all DCs

Hence simply demote DC and uninstall DNS and ADDS role and you will be fine, then what you said is true

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
rivkamakAuthor Commented:
Thank you for your help.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.