demote errors in DC

Question

demote errors in DC

HARUKI TUN 20

Hi Team,

I am migrating from win server 2012 R2 to win server 2022.
I already migrated FSMO roles from primary to new server. There is no issues so far after migrated roles. But the problem started the demotion to old server which 2012 R2.
I am getting errors as " the server is unwilling to process the request"
How should I demote this old server ?
I would appreciate if you shared your experience.
Thanks

TUN

Prakash Thakor 1 Reputation point

2023-03-18T04:43:56.79+00:00

Make sure AD health is good and all are synced before demoting,

May be you can turn off for some days before demoting.

If it created some problems during demote using GUI then you can remove it using these manual steps from this blog

https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564
HARUKI TUN 20 Reputation points

2023-03-18T05:03:47.6666667+00:00

Thank you for your comment and link.
I already checked AD health is good and all dcs are synced after migrated fsmo roles.

Could you please tell me more specific about you mentioned "turn off" for some days?
Is that meant old server to turn off after migrated fsmo roles.

1 answer

Your answer

Prakash Thakor 1 Reputation point

2023-03-18T04:43:56.79+00:00

Make sure AD health is good and all are synced before demoting,

May be you can turn off for some days before demoting.

If it created some problems during demote using GUI then you can remove it using these manual steps from this blog

https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564
HARUKI TUN 20 Reputation points

2023-03-18T05:03:47.6666667+00:00

Thank you for your comment and link.
I already checked AD health is good and all dcs are synced after migrated fsmo roles.

Could you please tell me more specific about you mentioned "turn off" for some days?
Is that meant old server to turn off after migrated fsmo roles.

Answer 1

Thameur-BOURBITA 36,496 Moderator

Hi @HARUKI TUN

If the DC health and replication are OK and you are unable to demote the old DC 2012 using GUI and Powershell , in this case , from new DC 2022you can perform a metadata cleanup to demote the old DC 2012 as mentioned in the link below:

Clean up Active Directory Domain Controller server metadata

After the metadata cleanup of the old DC , you have to keep it down and if you want reuse the server , you have to rebuild it from scratch

Please don't forget to mark helpful answer as accepted

HARUKI TUN 20 Reputation points

2023-03-21T12:53:58.9+00:00

Hi Thameur-BOURBITA,
Thank you for your comment.
I done it as you mentioned. But after metadata cleanup to demote the old DC 2012, the new server 2022 became to unavailable stage domain controllers and all's functioning were down. I was wondered it even though it was no issues before demote.
Do you know what is the possibility case?

Regards,
TUN
Thameur-BOURBITA 36,496 Reputation points Moderator

2023-03-21T20:25:05.4566667+00:00

Can you share run the following command dcdiag and share with us the result ?
HARUKI TUN 20 Reputation points

2023-03-22T00:58:56.12+00:00

Hi Thameur-BOURBITA,
Thank you for your comment.
Let me share dcdiag result on txt file. Please let me know if you have noticed something.

HARUKI TUN 20


Directory Server Diagnosis


Performing initial setup:

   Trying to find home server...

   Home Server = dc1

   * Identified AD Forest. 
   Done gathering initial info.


Doing initial required tests

   
   Testing server: Default-First-Site-Name\dc1

      Starting test: Connectivity

         ......................... dc1 passed test Connectivity



Doing primary tests

   
   Testing server: Default-First-Site-Name\dc1

      Starting test: Advertising

         ......................... dc1 passed test Advertising

      Starting test: FrsEvent

         ......................... dc1 passed test FrsEvent

      Starting test: DFSREvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems. 
         ......................... dc1 passed test DFSREvent

      Starting test: SysVolCheck

         ......................... dc1 passed test SysVolCheck

      Starting test: KccEvent

         ......................... dc1 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... dc1 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... dc1 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... dc1 passed test NCSecDesc

      Starting test: NetLogons

         ......................... dc1 passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... dc1 passed test ObjectsReplicated

      Starting test: Replications

         ......................... dc1 passed test Replications

      Starting test: RidManager

         ......................... dc1 passed test RidManager

      Starting test: Services

         ......................... dc1 passed test Services

      Starting test: SystemLog

         An error event occurred.  EventID: 0xC0001B63

            Time Generated: 03/22/2023   00:10:19

            Event String:

            A timeout (30000 milliseconds) was reached while waiting for a transaction response from the UmRdpService service.

         An error event occurred.  EventID: 0xC0001B63

            Time Generated: 03/22/2023   00:10:49

            Event String:

            A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ScDeviceEnum service.

         An error event occurred.  EventID: 0xC0001B58

            Time Generated: 03/22/2023   00:10:49

            Event String:

            The Smart Card Device Enumeration Service service failed to start due to the following error: 


         ......................... dc1 failed test SystemLog

      Starting test: VerifyReferences

         ......................... dc1 passed test VerifyReferences

   
   
   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

         ......................... ForestDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... ForestDnsZones passed test

         CrossRefValidation

   
   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

         ......................... DomainDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DomainDnsZones passed test

         CrossRefValidation

   
   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Schema passed test CrossRefValidation

   
   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Configuration passed test CrossRefValidation

   
   Running partition tests on : burmaworld

      Starting test: CheckSDRefDom

         ......................... burmaworld passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... burmaworld passed test CrossRefValidation

   
   Running enterprise tests on : burmaworld.biz

      Starting test: LocatorCheck

         Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1355

         A Global Catalog Server could not be located - All GC's are down.

         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355

         A Primary Domain Controller could not be located.

         The server holding the PDC role is down.

         ......................... burmaworld.biz failed test LocatorCheck

      Starting test: Intersite

         ......................... burmaworld.biz passed test Intersite

Thameur-BOURBITA 36,496 Reputation points Moderator

2023-03-22T08:21:12.4233333+00:00

@YE WIN TUN •

The PDC role seems down.

Can you check if all FSMO roles are moved correctly the DC 2022 ?

run the following command to check which DC has FSMO the roles you can check the result with us :

netdom query fsmo

Check if Global Catalogue is alreday enabled on new DC 2022.

Please don't forget to mark helpful answer as accepted
HARUKI TUN 20 Reputation points

2023-03-22T09:10:32.8066667+00:00

Hi Thameur-BOURBITA ,
Thank you for your comment. Appreciate it.
I already checked with your command that all FSMO roles are moved correctly to new DC 2022. For Global Catalogue, I checked it from properties of active directory sites and services. Its enabled on new DC 2022.
Normally, can we demote the old server 2012 after fsmo roles to new DC 2022? Do we need to configure or change something before demote ?
If not, I was wondered it why unable to demote.
Thameur-BOURBITA 36,496 Reputation points Moderator

2023-03-22T09:22:45.43+00:00

Before demote the old DC you should check and be sure that the active directory health is ok . But folowing to the result of DCdiag , it seems that you still have replication issue.

Did you turn off the old DC 2012 ?

Try to reboot the DC 2022 and run the following comand dcdiag and repadmin /showrepl

You can share the result here with us to help you

HARUKI TUN 20

Hi Thameur-BOURBITA,
Thank you for your comment and help.
I have checked before migrate FSMO roles and after migrate FSMO roles. When I checked it , it was fine. But now, its not like I sent you. Let me share again with you as you mentioned.

repadmin /showrepl

Repadmin: running command /showrepl against full DC localhost
Default-First-Site-Name\dc3
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: c5c7a281-0f64-4cc7-9939-8b218578225c
DSA invocationID: 7c3f777c-add4-4344-87ac-579808cb9070

==== INBOUND NEIGHBORS ======================================

DC=burmaworld,DC=biz
    Default-First-Site-Name\dc1 via RPC
        DSA object GUID: 1429c8f4-7efa-446e-9bd0-0901e5a3d9a4
        Last attempt @ 2023-03-22 12:13:37 was successful.

CN=Configuration,DC=burmaworld,DC=biz
    Default-First-Site-Name\dc1 via RPC
        DSA object GUID: 1429c8f4-7efa-446e-9bd0-0901e5a3d9a4
        Last attempt @ 2023-03-22 11:49:01 was successful.

CN=Schema,CN=Configuration,DC=burmaworld,DC=biz
    Default-First-Site-Name\dc1 via RPC
        DSA object GUID: 1429c8f4-7efa-446e-9bd0-0901e5a3d9a4
        Last attempt @ 2023-03-22 11:49:01 was successful.

DC=ForestDnsZones,DC=burmaworld,DC=biz
    Default-First-Site-Name\dc1 via RPC
        DSA object GUID: 1429c8f4-7efa-446e-9bd0-0901e5a3d9a4
        Last attempt @ 2023-03-22 11:49:01 was successful.

DC=DomainDnsZones,DC=burmaworld,DC=biz
    Default-First-Site-Name\dc1 via RPC
        DSA object GUID: 1429c8f4-7efa-446e-9bd0-0901e5a3d9a4
        Last attempt @ 2023-03-22 11:49:01 was successful.

Directory Server Diagnosis


Performing initial setup:

   Trying to find home server...

   Home Server = dc3

   * Identified AD Forest. 
   Done gathering initial info.


Doing initial required tests

   
   Testing server: Default-First-Site-Name\dc3

      Starting test: Connectivity

         ......................... dc3 passed test Connectivity



Doing primary tests

   
   Testing server: Default-First-Site-Name\dc3

      Starting test: Advertising

         Warning: DsGetDcName returned information for \\dc1.burmaworld.biz,

         when we were trying to reach dc3.

         SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.

         ......................... dc3 failed test Advertising

      Starting test: FrsEvent

         ......................... dc3 passed test FrsEvent

      Starting test: DFSREvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems. 
         ......................... dc3 passed test DFSREvent

      Starting test: SysVolCheck

         ......................... dc3 passed test SysVolCheck

      Starting test: KccEvent

         ......................... dc3 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... dc3 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... dc3 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... dc3 passed test NCSecDesc

      Starting test: NetLogons

         Unable to connect to the NETLOGON share! (\\dc3\netlogon)

         [dc3] An net use or LsaPolicy operation failed with error 67,

         The network name cannot be found..

         ......................... dc3 failed test NetLogons

      Starting test: ObjectsReplicated

         ......................... dc3 passed test ObjectsReplicated

      Starting test: Replications

         ......................... dc3 passed test Replications

      Starting test: RidManager

         ......................... dc3 passed test RidManager

      Starting test: Services

         ......................... dc3 passed test Services

      Starting test: SystemLog

         ......................... dc3 passed test SystemLog

      Starting test: VerifyReferences

         ......................... dc3 passed test VerifyReferences

   
   
   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

         ......................... DomainDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DomainDnsZones passed test

         CrossRefValidation

   
   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

         ......................... ForestDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... ForestDnsZones passed test

         CrossRefValidation

   
   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Schema passed test CrossRefValidation

   
   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Configuration passed test CrossRefValidation

   
   Running partition tests on : burmaworld

      Starting test: CheckSDRefDom

         ......................... burmaworld passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... burmaworld passed test CrossRefValidation

   
   Running enterprise tests on : burmaworld.biz

      Starting test: LocatorCheck

         ......................... burmaworld.biz passed test LocatorCheck

      Starting test: Intersite

         ......................... burmaworld.biz passed test Intersite

Thameur-BOURBITA 36,496 Reputation points Moderator

2023-03-22T14:42:38.36+00:00

@YE WIN TUN •

I see that you have two DCs named DC3 and DC1.

It seems that the DC 2012 still exist in the GUI of sites and service active directory on DC 2022.

Can you connect on DC 2022 then open the GUI sites and services active directory and check if there is a connection object related to old DC 2012 ?

Don't hesitate to share a screenshot here to be able to help you.

Please don't forget to mark helpful answer as accepted
HARUKI TUN 20 Reputation points

2023-03-23T00:45:55.4966667+00:00

Hi Thameur-BOURBITA,
Thank you for your help.
Yes I have two DCs named DC1 which old server win 2012 and DC3 which new server win 2022. I moved FSMO roles from DC1 to DC3.
After that, I did not configure or change it in GUI of sites and services. I took screenshot for you as you mentioned. Let me share it.
HARUKI TUN 20 Reputation points

2023-03-23T00:49:43.8466667+00:00

NTDS settings-2.jpg
HARUKI TUN 20 Reputation points

2023-03-23T00:50:12.72+00:00

NTDS settings.jpg
HARUKI TUN 20 Reputation points

2023-03-23T07:30:55.8466667+00:00

NTDS settings-3.jpg
Thameur-BOURBITA 36,496 Reputation points Moderator

2023-03-23T07:35:38.79+00:00

@YE WIN TUN •

you have to delete the old server DC1 from sites and services GUI to complete the metadata cleanup.

if it still exists in this GUI , the new DC3 will continue trying replicate with it and generate errors.

Please don’t forget to mark helpful answer as accepted
HARUKI TUN 20 Reputation points

2023-03-23T07:45:07.93+00:00

Hi Thameur-BOURBITA,
Thank you for your help.
I tried to delete it from sites and services by GUI but it showed errors as below.
Thameur-BOURBITA 36,496 Reputation points Moderator

2023-03-23T12:49:43.3433333+00:00

Which DC you have selected?

you have to select old DC 2012

Please don’t forget to mark helpful answer as accepted
HARUKI TUN 20 Reputation points

2023-03-23T13:04:44.1366667+00:00

Hi Thameur-BOURBITA,
Thank you for your help.
Yes, I have selected the old DC 2012. But I could not able to delete.
Thameur-BOURBITA 36,496 Reputation points Moderator

2023-03-23T14:04:15.7666667+00:00

@YE WIN TUN •

Can you check if the console is alreday connected on DC2022?

Open the Active Directory Sites and Services console. When the console opens, right click on the Active Directory Sites and Services container and select the Change Domain Controller command to select the DC2022 and be sure that console is connected on it

Once done , try again to delete the old DC2012.

Please don't forget to mark helpful answer as accepted

Share via

demote errors in DC

1 answer

Your answer