Need to make my client computers get Group policy update from Different Domain controllers in the Domain

Question

Need to make my client computers get Group policy update from Different Domain controllers in the Domain

admin-ayoola 30

I have four Domain controllers running Windows Server 2022.. I need to decommission one of the domain controllers, but i noticed all my client computers are getting GP update from this domain controller.

I have set a group policy to make all my client computer get group policy update from the PDC but this is not solving the solution as all client computers are still getting their group policy from the DC that need to be decommissioned.

Please i need suggestion on how to resolve the issue.

Gideon Eichhorn 0 Reputation points

2025-03-31T17:26:17.5566667+00:00

Im a admin how do i get to discord
admin-ayoola 30 Reputation points

2025-04-01T16:23:59.4766667+00:00

How Do i make Group polies applied from a Particular DC

Answer accepted by question author

0 additional answers

Your answer

Gideon Eichhorn 0 Reputation points

2025-03-31T17:26:17.5566667+00:00

Im a admin how do i get to discord
admin-ayoola 30 Reputation points

2025-04-01T16:23:59.4766667+00:00

How Do i make Group polies applied from a Particular DC

Answer 1

Hello admin-ayoola,

Thank you for posting in Q&A forum.

Please check the information below before you demote the one DC you want.

1.Please check the Domain Controllers in your domain. You can check it by running command:

netdom query dc

For example:

User's image

nltest /dclist:domain.com

For example (domain name is the actual domain name in your environment):

User's image

You can also check it via GUI on one domain controller.

User's image

2.Make sure the SYSVOL and Netlogon folder on each DC are shared.

User's image

3.Please check the AD replication by running commands below on PDC:

repadmin /showrepl >C:\rep1.txt

repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

4.Please check the SYSVOL replication between all the DC. Make sure all the contents in the path C:\Windows\SYSVOL\domain\Policies are the same on all DCs.

User's image

5.Please make sure the DC you need to be decommissioned is not PDC. If it is PDC, please transfer the five FSMO roles to another DC.

6.You mentioned that all my client computers are getting GP update from this domain controller (you want to demote), if this DC was a DNS server, please update the DNS client configuration on all member workstations, member servers, and other DCs that might have used this DNS server for name resolution. If it is required, modify the DHCP scope to reflect the removal of the DNS server.

7.If this domain controller was a global catalog server, evaluate whether application servers that pointed to this global catalog server must be pointed to another live global catalog server.

8.If this DC was a global catalog server, evaluate whether an additional global catalog must be promoted to the address site, the domain, or the forest global catalog load.

9.If this was a DNS server, update the Forwarder settings and the Delegation settings on any other DNS servers (DC server) that might have pointed to this DC for name resolution.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

admin-ayoola 30 Reputation points

2025-04-01T14:57:11.7266667+00:00

Hello Daisy,

Thank you for the detailed response. I have actually implemented some of the recommendations. My target is to ensure clients computers can only get group policy updates from other DCs in the domain. The DC to be decommissioned is not a PDC. When the DC was demoted previously, all group policy update started failing on client computers but successful on the other Domain controllers. I had to reprovision the DC with the same name before GP update is successful.

is there a way to point client computers to the other DC for GP update? Thank you once again for your response
Anonymous

2025-04-02T01:19:13.69+00:00

Hello
Good day!
Based on my knowledge, in a standard Active Directory environment, clients don’t get to “choose” the DC for processing Group Policy—the DC is selected automatically via the Domain Controller Locator mechanism (which uses DNS and AD site information) to pick the closest/most appropriate DC. That said, here are some steps you might consider if you need a particular DC to serve policy updates:

Use Active Directory Sites and Services

1.Clients choose a DC based on their AD site. If you want clients to use a particular DC, make sure that this DC is the only available DC in that AD site.

2.If the clients are in a site that has multiple DCs, you can reconfigure the site (or the subnets assigned to it) so that only your preferred DC is in that site. This is the most “supported” method of influencing which DC a client uses.

Force a Group Policy Refresh and Verify

Please note:

There isn’t a built‑in Group Policy setting or command switch to explicitly choose which DC to use. The DC selection process is controlled by Active Directory.

If you need Group Policy to be processed by a specific DC, the best practice is to ensure that the clients are in an AD site that contains only that DC. This way, the Domain Controller Locator service will naturally pick your preferred DC when applying policies.

Best Regards,
Daisy Zhou