다음을 통해 공유


Demote Active Directory Server from Forest

Last night I faced a critical issue over one of active directory servers. It could not replicate data over the forest. After long search I found the need to remove the failed DC server from the forest.

Error below:

It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded the tombstone lifetime. Replication has been stopped with this source. 
The reason that replication is not allowed to continue is that the two machine's views of deleted objects may now be different. The source machine may still have copies of objects that have been deleted (and garbage collected) on this machine. If they were allowed to replicate, the source machine might return objects which have already been deleted.

To  remove a server from the forest follow the below steps:

  1. Forceful removal of DC
  2. Metadata cleanup 

Before you start you need to make sure there is a server on the network to serve authentication requests. To check you can run the below command:

netdom /query fsmo

http://tmitegypt.files.wordpress.com/2013/05/fsmo011.png?w=407

Forceful removal of DC

To resolve this behavior for Windows Server 2008 can run the dcpromo/forceremoval command to forcibly remove AD DS from a domain controller.

  • Click Start, click Run, and then type the following command: dcpromo /forceremoval
  • Click OK.

http://tmitegypt.files.wordpress.com/2013/05/remove01.png?w=650http://tmitegypt.files.wordpress.com/2013/05/remove02.png?w=650http://tmitegypt.files.wordpress.com/2013/05/remove03.png?w=650

  • At the Welcome to the Active Directory Installation Wizard page, click Next.

http://tmitegypt.files.wordpress.com/2013/05/remove04.png?w=493http://tmitegypt.files.wordpress.com/2013/05/remove05.png?w=496

  • Type administrator password

http://tmitegypt.files.wordpress.com/2013/05/remove07.png?w=650

  • If DNS service detected on the server a warning massage will appear. Click ok to delete the DNS configuration. 

http://tmitegypt.files.wordpress.com/2013/05/remove06.png?w=650

  • On Summary click next.

http://tmitegypt.files.wordpress.com/2013/05/remove08.png?w=650

  • After completing click finish

http://tmitegypt.files.wordpress.com/2013/05/remove09.png?w=493

If the computer that you are removing is a global catalog server, click OK in the message window.

**Metadata cleanup **

To clean up the metadata need to use the Ntdsutil.exe tool. This will be used on the DC server with below services:

  • Active Directory Sites and Services,
  • Active Directory Users and Computers.

Also, make sure that you use an account that is a member of the Enterprise Admins universal group.

Caution: Using the Ntdsutil utility incorrectly may result in partial or complete loss of Active Directory functionality.

To clean up metadata:

  • At the command line, type Ntdsutil and press ENTER.

http://tmitegypt.files.wordpress.com/2013/05/nt01.png?w=650

  • At the Ntdsutil: prompt, type metadata cleanup and press Enter.

http://tmitegypt.files.wordpress.com/2013/05/nt02.png?w=587

  • At the metadata cleanup: prompt, type connections and press Enter.

http://tmitegypt.files.wordpress.com/2013/05/nt03.png?w=585

  • At the server connections: prompt, type connect to server <servername>, where <servername> is the domain controller (any functional domain controller in the same domain) from which you plan to clean up the metadata of the failed domain controller. Press Enter.

http://tmitegypt.files.wordpress.com/2013/05/nt04.png?w=554

  • Type quit and press Enter to return you to the metadata cleanup: prompt.

http://tmitegypt.files.wordpress.com/2013/05/nt05.png?w=582

  • Type select operation target and press Enter.

http://tmitegypt.files.wordpress.com/2013/05/nt06.png?w=473

  • Type list domains and press Enter. This lists all domains in the forest with a number associated with each.

http://tmitegypt.files.wordpress.com/2013/05/nt07.png?w=614

  • Type select domain <number>, where <number> is the number corresponding to the domain in which the failed server was located. Press Enter.

http://tmitegypt.files.wordpress.com/2013/05/nt08.png?w=624

  • Type list sites and press Enter.

http://tmitegypt.files.wordpress.com/2013/05/nt09.png?w=632

  • Type select site <number>, where <number> refers to the number of the site in which the domain controller was a member. Press Enter.

http://tmitegypt.files.wordpress.com/2013/05/nt10.png?w=632

  • Type list servers in site and press Enter. This will list all servers in that site with a corresponding number.

http://tmitegypt.files.wordpress.com/2013/05/nt11.png?w=632

  • Type select server <number> and press Enter, where <number> refers to the domain controller to be removed.

http://tmitegypt.files.wordpress.com/2013/05/nt12.png?w=588

  • Type quit and press Enter. The Metadata cleanup menu is displayed.

http://tmitegypt.files.wordpress.com/2013/05/nt13.png?w=400

  • Type remove selected server and press Enter.

http://tmitegypt.files.wordpress.com/2013/05/nt14.png?w=585

You will receive a warning message. Read it, and if you agree, press Yes.

At this point, Active Directory confirms that the domain controller was removed successfully. If you receive an error that the object could not be found, Active Directory might have already been removed from the domain controller.

  • In Active Directory Sites and Services, expand the appropriate site.

http://tmitegypt.files.wordpress.com/2013/05/remove142.png?w=516

  • Delete the server object associated with the failed domain controller.

http://tmitegypt.files.wordpress.com/2013/05/remove15.png?w=650

  • In Active Directory Users and Computers, expand the domain controllers container.

  • Delete the computer object associated with the failed domain controller.

  • AD will display another confirmation window. If you're sure that you want to delete the failed object, click Yes.

  • To remove the failed server object from DNS

  • In the DNS snap-in, expand the zone that is related to the domain from which the server has been removed.

  • Remove the CNAME record in the _msdcs.root domain of forest zone in DNS. You should also delete the HOSTNAME and other DNS records.

  • If you have reverse lookup zones, also remove the server from these zones.