Error demoting Domain Controller

Question

Hello everyone,

I'm currently transfering the role of DC from two server to two other servers. The OS I am running is Windows Server 2019. I demoted one server without problems but when I try to demote my other server it gives the following error: "No other DC could be contacted but other DC are in the directory." In order to safely transfer to role of DC to the new DC's they need to be contacted before I proceed since forcing the demoting will break AC in my domain (I have tried this).

When I go the AC sites and services the servers seem to replicate with eachother.

Another problem is that w32time is broken on the old DC, that is why I'm trying to transfer the role to new DC's in the first place. I am not sure whether this is the cause of the problem.

I tried altering the DNS settings: On the old DC the primary DNS points to a new DC and the secondary to itself. On the new DC the primary points to the old and the secondary to itself.

Does anybody have any idea what I could do to fix this?

Thanks in advance,

Greetings Daniël

Answer 1

Sorry I'll be more clear. SRV1 and SRV2 used to be my DC's but I demoted them. They are the ones having problems.

Then they would not be able to use NT5DS time source. You'll need to configure them with an NTP source (which can be your PDCe's ip address).

w32tm /unregister
net stop w32time
w32tm /register
net start w32time
w32tm /config /manualpeerlist:<ntp ip address> /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time
then check
w32tm /query /source
w32tm /query /configuration

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

At some point I made the foolish decision to make SRV1 and SRV2 a meinberg NTP server

No clue on that. May be time to rebuild them from scratch.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Sounds good, glad to have helped.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

If the partition was created manually, or if it was created by using another program, you can remove it by using the Ntdsutil utility:

Open a command prompt, and then type ntdsutil.

From the Ntdsutil prompt, type domain management.

In the Domain Management window, type connections.

Type connect to server <yourservername>.

After the binding message appears, you will have a successful connection to your server.

In the Server Connections window, type quit.

In the Domain Management window, type list. A list of the naming contexts on this server appears.

To remove the application directory partition replica, type remove nc replica <ApplicationDirectoryPartition> <DomainController>.

At the Ntdsutil prompt, type Q, and then press ENTER until you are returned to the CMD command prompt. You can now successfully demote this domain controller. You may have to restart this domain controller before you start the Active Directory Installation wizard again.

Answer 5

You can seize roles (if necessary) to another healthy one
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-fsmo-roles-in-ad-ds

then perform cleanup to remove the failed one.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564

--please don't forget to upvote and Accept as answer if the reply is helpful--