How to properly decommission obsolete AADConnect server?

Question

Hello,

We have total three AADConnect DEV servers.

Server #1 AADConnect version 1.6.16.0 : Windows 2K12 OS: Staging, local database

Server #2 AADConnect version 2.1.1.0: Windows 2K19 OS :Active mode, local database

Server #3 AADConnect version 2.1.1.0: Windows 2K19 OS : Staging mode, local database

We would like to get rid of server #1 (Windows 2K12 OS). Can we simply shut it off or should AADConnect client be uninstalled first from the server?
Is there other related steps that should be taken care of?

Thanks!

Answer

General Process

Confirm your replacement server(s) are functioning, and one is in active mode.
Query for current AD Connector Account and record/delete. If this is a MSOL_ account, I recommend deleting personally but that's up to you. If you are re-using accounts (which isn't best practice), do not delete it.
Uninstall AD Connect.
Remove server from AD Connect Health Monitoring (if applicable).
Delete Azure AD Connect Account that was tied to the install of AD Connect for said server (the UPN should start with Sync_NameofComputer)

Deleting Server from AD Connect Health monitoring:

Go to Azure Active Directory Connect Health → Sync Services
Select the corresponding service name (Tenant.onmicrosoft.com)
Under Azure Active Directory Connect Servers, select the server that is being decommissioned. A new pane will appear.
Click the Delete button near the top.
Type the server name and click the Delete button near the bottom.

Pulled this from my decommissioning notes, I went through a 1.X to 2.X swing migration upgrade and completed it 3-4 months ago. Upgrade went smooth, and we've had no issues post decommission. I'd recommend grabbing an AAD configuration backup just in case.

Some helpful code as well below corresponding to steps

    #Backup AAD Config if necessary  
    Get-ADSyncServerConfiguration -Path $PathHere  
      
    #Step 2 General Process  
    Import-Module "C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\AdSyncConfig.psm1"  
    $ConnectorAccount = Get-ADSyncADConnectorAccount | Select-Object -ExpandProperty ADConnectorAccountName  
    $ConnectorAccount  
    Remove-ADUser -Identity $ConnectorAccount  
      
    #Step 5 General Process  
    Connect-AzureAD  
    Get-AzureADUser -SearchString 'On-Premises Directory Synchronization Service Account'  
    # Determine proper object ID from list, if needed  
    Remove-AzureADUser -ObjectId "$ObjectIDhere"

Answer

You can follow Jeff's steps here and uninstall AADConnect and remove the old account associated with it:

https://blog.expta.com/2021/07/how-to-migrate-aad-connect-to-new-server.html

I would remove the agent for that old server in Azure as well if its enabled:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-operations

Share via

How to properly decommission obsolete AADConnect server?

2 answers