Error Demoting Server 2008R2 Domain Controller

Question

Our domain has a working 2019 Standard domain controller. When I ran DCPROMO to remove a 2008 R2 domain controller, I received this error:

Active Directory Domain Services could not transfer the remaining data in directory partition DC=ForestDNSZones,DC=ourdomain,DC=com to \OUR2019SRVR.ourdomain.com

A dsquery I ran references a server no longer part of the domain:

CN=NTDS Settings\0ADEL:764e2527-7deb-4368-aeaa-a522d42264b5,CN=OLDSERVER\0ADEL: 99118ba6-6bfa-4ae4-a825-a569473329d4,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=ourdomain,DC=com

I wasn't sure if I should run the fixfsmo.vbs script I found at:

https://learn.microsoft.com/en-US/troubleshoot/windows-server/identity/error-run-adprep-rodcprep-command

I'm not well versed in scripts and wasn't 100% certain if this would replace the reference to the old server with our current DC that holds all FSMO roles, and allow DCPROMO to work. Any ideas or suggestions greatly appreciated.

Thanks,
Mike

Answer 1

Hello @Mike N ,

Thank you for your update.

Here are the answers for your references.

Q1: Also, in AD Sites and Services my 2019 server is listed but the NTDS settings are blank.
A1: Do you mean there is no NTDS setting object corresponding to this new 2019 DC ?
For example：
I have 5 DCs, all of them have their NTDS setting object.

If you mean there is no NTDS setting object corresponding to this new 2019 DC, it means the new 2019 DC is not promoted as a DC successfully.

Or do you mean there is no replication partner of the new 2019 DC?

For example:
Vchzho720VM has three replication partners.

If you mean there is no replication partner of the new 2019 DC, it is normal if you have only one new 2019 DC in your AD forest (for old 2008 DC, it is removed even though there are some residual DNS records now).

Q2: If either of you have any input on what might be going on with the NTDS settings, and if I should just remove any of the 2008 server references in DNS,
A2: You should delete them if you do not need it at all.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

This one may help.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/dcpromo-demotion-fails

Worst case you should be able to seize roles to another healthy domain controller.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-fsmo-roles-in-ad-ds

then perform cleanup to remove the remnants.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Hello @Mike N ,

Thank you for posting here.

To better understand your question, please confirm the following information at your convenience.

1. Is your AD forest single forest with single domain or multiple domains?
2. If your forest is single forest with multiple domains, how many domains are there?
3. What is forest functional level and domain functional level?
4. How many DCs are there in the same domain as this 2008R2 Domain Controller? Please run command nltest /dclist:domain.com to check.
5. Which DC holds the FSMO roles? Please run command netdom query FSMO to check.

Meanwhile, here is a document that similar to your issue. You can try the resolution within the link.

DCPROMO demotion fails if it's unable to contact the DNS infrastructure master
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/dcpromo-demotion-fails

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 4

should just remove any of the 2008 server references in DNS

Yes, remove the records.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 5

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--