Updating and Migrating the KDS Root Key after decommissioning AD Domain Controller

Question

What steps should I follow to successfully update the KDS Root Key value?

When I execute the below simple command:

(Get-KdsRootKey).domaincontroller

https://learn.microsoft.com/en-us/powershell/module/kds/get-kdsrootkey?view=windowsserver2025-ps

The result is the old AD Domain Controller which has been decommissioned and is no longer in the netdom query dc result.

The old server mentioned in the previous command has been decommissioned in the last 30 days.

Any help would be greatly appreciated.

Answer 1

Hello EnterpriseArchitect,

Thank you for posting in Q&A forum.

Based on the description "The old server mentioned in the previous command has been decommissioned in the last 30 days.", do you mean the old DC is demoted and removed from the domain in the last 30 days? If so, it seems the KDS Root Key about this old DC cannot be updated and migrated. Because I can see information in the link below:

KDS root keys are stored in Active Directory in container CN=Master Root Keys,CN=Group Key Distribution Service,CN=Services,CN=Configuration,DC=<forest name>;. They have an attribute msKds-DomainID that links to the computer account of the Domain Controller that created the object. When this domain controller is demoted and removed from the domain, the value will refer to the tombstone of the computer account. You can ignore the broken value as it is only used to help the administrator track the object when it's freshly created. You may also change the attribute value and point it to the computer object of another domain controller in your forest.

Create the Key Distribution Services KDS Root Key

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key

If you have other Domain Controllers, you can change the attribute value above and point it to the computer object of another domain controller in your forest.

In my lab:

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.