This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 81%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMB%3C/text%3E%3C/svg%3E)
I promoted a DC as the only DC running Server 2019 for a subdomain to demonstrate the process to students. Now I'm trying to demote it again but this fails in a confusing way.
Server Manager / PowerShell claim "The domain controller for the domain cannot be found" while DCPROMO.LOG states that the DC for the parent domain is reachable and some things were done on the parent-DC before the error.
All messages indicate a problem replicating the "Schema" Active Directory partition. But running "repadmin /showrepl" shows that replication is working fine and the "Schema" partition is replicated regularly from the same parent-DC. DCPROMO.LOG ends with the following line "EVENTLOG (Error): NTDS Replication / Replikation : 2023".
I triple-checked the other "usual suspects" like network config and DNS but everything is OK. Does anybody have any idea what the issue here is`?
Thank in advance!
Note: DC is running German windows and the messages are translated by me.
I've found a workaround, but I'm still curious about the root cause of the issue. Anybody any ideas?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Ok, got you. You can follow along here.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/remove-orphaned-domains
--please don't forget to upvote and Accept as answer if the reply is helpful--
Thanks, this seems to be what I was looking for. I try it tomorrow with my students and report back.
Sounds good.
Almost ;-) The problem with the above documents is that they are only concerned about LDAP and ignore DNS. This goes for DCs as well as domains.
I followed the link in the 2nd answer and got "metadata cleanup: remove selected domain DsRemoveDsDomainW error 0x2015 (The directory service can perform the requested operation only on a leaf object.)" when trying to delete the domain. But this led me on the right track: the DC in question was also a DNS server, so it had a child item in it's naming context "DC=DomainDnsZones". So selecting and deleting the domain failed. I first had to delete the child item:
ntdsutil
Partition management
list
delete NC DC=DomainDnsZones,DC=sub,DC=buettemeyer,DC=loc
delete NC DC=sub,DC=buettemeyer,DC=loc
For completenes: I also connected to the domain naming master as DC as per MS's instruction
Ok, thanks for this feedback and glad the problem is solved.
The simplest solution may be to remove it from network then perform some cleanup to remove remnants.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564
--please don't forget to upvote and Accept as answer if the reply is helpful--
Thought about that, but the above links explain how to remove the remnants of a DC from a domain. This does not apply to my case: since I'm demoting the only DC for a domain the entire domain would be deleted anyway. BUT I'd need to clean up the remnants of the entire sub-domain from the parent-domain and I haven't found any info regarding this.