Demoting AD Domain Controller

David Ostermeyer 21 Reputation points
2022-12-02T18:26:57.793+00:00

When we try to force the demoting of an AD Domain Controller we keep getting the error below

The operation failed because:
Failed to prepare for or remove the sysvol replication
the operation identifier is not valid

Windows for business | Windows Client for IT Pros | Directory services | Active Directory
0 comments No comments
{count} votes

Accepted answer
  1. Anonymous
    2022-12-02T19:44:35.41+00:00

    Much simpler to use the GUI to remove.
    https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564

    Make sure the MMC is connected to a healthy domain controller. Change Domain Controller if needed
    266753-image.png

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    2 people found this answer helpful.
    0 comments No comments

6 additional answers

Sort by: Most helpful
  1. Anonymous
    2022-12-02T18:34:48.437+00:00

    The simplest solution may be to remove the failed one from network then perform some cleanup to remove remnants.
    https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
    https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    1 person found this answer helpful.

  2. David Ostermeyer 21 Reputation points
    2022-12-02T19:34:57.837+00:00

    C:\Windows\system32>ntdsutil
    ntdsutil: metadata cleanup
    metadata cleanup: remove selected server TF-DC1
    Binding to localhost ...
    Connected to localhost using credentials of locally logged on user.
    LDAP error 0x22(34 (Invalid DN Syntax).
    Ldap extended error message is 0000208F: NameErr: DSID-03100232, problem 2006 (BAD_NAME), data 8350, best match of:
    'CN=Ntds Settings,TF-DC1'

    Win32 error returned is 0x208f(The object name has bad syntax.)
    )
    Unable to determine the domain hosted by the Active Directory Domain Controller (5). Please use the connection menu to specify it.

    0 comments No comments

  3. David Ostermeyer 21 Reputation points
    2022-12-02T19:44:34.55+00:00

    C:\Windows\system32>ntdsutil
    ntdsutil: metadata cleanup
    metadata cleanup: connections
    server connections: connect to server tf-dc1
    Binding to tf-dc1 ...
    DsBindWithSpnExW error 0x5(Access is denied.)
    ldap_search for attribute supportedCapabilities failed with 0x59(89 (Parameter Error).
    )
    server connections:

    0 comments No comments

  4. David Ostermeyer 21 Reputation points
    2022-12-02T19:45:41.29+00:00

    The new DC does not see the old one since we removed everything from sites and services and users and computers


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.