The DCPROMO (Dcpromo.exe) utility is used for promoting a server to a domain
controller and demoting a domain controller to a member server (or to a
standalone server in a workgroup if the domain controller is the last in the
domain). As part of the demotion process, the DCPROMO utility removes the
configuration data for the domain controller from the Active Directory. This data
takes the form of an "NTDS Settings" object, which exists as a child to the server
object in the Active Directory Sites and Services Manager .
The information is in the following location in the Active Directory:
CN=NTDS
Settings,CN=,CN=Servers,CN=,CN=Sites,CN=Configu
ration,DC=...
The attributes of the NTDS Settings object include data representing how the
domain controller is identified in respect to its replication partners, the naming
contexts that are maintained on the machine, whether or not the domain
controller is a Global Catalog server, and the default query policy. The NTDS
Settings object is also a container that may have child objects that represent the
domain controller's direct replication partners. This data is required for the
domain controller to operate within the environment, but is retired upon demotion.
In the event that the NTDS Settings object is not removed properly (for example,
the NTDS Settings object is not properly removed from a demotion attempt), the
administrator can use the Ntdsutil.exe utility to manually remove the NTDS
Settings object. The following steps list the procedure for removing the NTDS
Settings object in the Active Directory for a given domain controller. At each
NTDSUTIL menu, the administrator can type help for more information about the
available options.
CAUTION : The administrator should also check that replication has occurred
since the demotion before manually removing the NTDS Settings object for any
server. Using the NTDSUTIL utility improperly can result in partial or complete
loss of Active Directory functionality.
1. Click Start , point to Programs , point to Accessories , and then click Command
Prompt .
2. At the command prompt, type ntdsutil .
3. Type metadata cleanup , and then press ENTER. Based on the options given, the
administrator can perform the removal, but additional configuration parameters
need to be specified before the removal can occur.
4. Type connections and press ENTER. This menu is used to connect to the specific
server on which the changes occur. If the currently logged on user does not have
administrative permissions, alternate credentials can be supplied by specifying the
credentials to use before making the connection. To do so, type set creds domain
name username password and press ENTER. For a null password, type null for
the password parameter.
5. Type connect to server servername , and then press ENTER. You should receive
confirmation that the connection is successfully established. If an error occurs,
verify that the domain controller being used in the connection is available and the
credentials you supplied have administrative permissions on the server.
NOTE : If you attempt to connect to the same server that you want to delete,
when you attempt to delete the server referred to in step 15, you may receive the
following error message:
Error 2094. The DSA Object cannot be deleted0x2094
6. Type quit and press ENTER. The Metadata Cleanup menu is displayed.
7. Type select operation target and press ENTER.
8. Type list domains and press ENTER. A list of domains in the forest is displayed,
each with an associated number.
9. Type select domain number and press ENTER, where number is the number
associated with the domain to which the server you are removing is a member.
The domain you select is used to determine if the server being removed is the last
domain controller of that domain.
10. Type list sites and press ENTER. A list of sites, each with an associated number,
is displayed.
11. Type select site number and press ENTER, where number is the number
associated with the site to which the server you are removing is a member. You
should receive a confirmation listing the site and domain you chose.
12. Type list servers in site and press ENTER. A list of servers in the site, each with
an associated number, is displayed.
13. Type select server number , where number is the number associated with the
server you want to remove. You receive a confirmation listing the selected server,
its Domain Name Server (DNS) host name, and the location of the server's
computer account you want to remove.
14. Type quit and press ENTER. The Metadata Cleanup menu is displayed.
15. Type remove selected server and press ENTER. You should receive
confirmation that the removal completed successfully. If you receive the
following error message:
Error 8419 (0x20E3)
The DSA object could not be found
the NTDS Settings object may already be removed from the Active Directory as
the result of another administrator removing the NTDS Settings object, or
replication of the successful removal of the object after running the DCPROMO
utility.
NOTE : You may also see this error when you attempt to bind to the domain
controller that is going to be removed. Ntdsutil needs to bind to a domain
controller other than the one that is going to be removed with metadata cleanup.
16. Type quit at each menu to quit the NTDSUTIL utility. You should receive
confirmation that the connection disconnected successfully.
17. Remove the cname record in the _msdcs. root domain of forest zone in DNS.
Assuming that DC is going to be reinstalled and re-promoted, a new NTDS
settings object is created with a new globally unique identifier (GUID) and a
matching cname record in DNS. You do not want the DC's that exist to use the
old cname record.
As best practice you should delete the hostname and other DNS records. If the
lease time that remains on Dynamic Host Configuration Protocol (DHCP) address
assigned to offline server is exceeded then another client can obtain the IP address
of the problem DC.
Now that the NTDS setting object has been deleted we can now delete the following
objects:
1. Use ADSIEdit to delete the computer account in the OU=Domain
Controllers,DC=domain...
NOTE : The FRS subscriber object is deleted when the computer object is
deleted, since it is a child of the computer account.
2. Use ADSIEdit to delete the FRS member object in CN=Domain System Volume
(SYSVOL share),CN=file replication service,CN=system....
3. In the DNS console, use the DNS MMC to delete the cname (also known as the
Alias) record in the _msdcs container.
4. In the DNS console, use the DNS MMC to delete the A (also known as the Host)
record in DNS.
5. If the deleted computer was the last domain controller in a child domain and the
child domain was also deleted, use ADSIEdit to delete the trustDomain object for
the child in CN=System, DC=domain, DC=domain, Domain NC.
No comments:
Post a Comment