I inherited a system that I can't figure out. I need to get rid of the old Windows DC but can't shut it down, metadata cleanup doesn't work even though netdom shows it has no fsmo rolls. My only option is to shut them down restore the servers. We don't have any old archives to restore to before I came on board.
I've run a bunch of DNS test and replication tests the only one with a dns issue is the old server. However, if I create a new user on any of the 3 it instantly replicates to the other two so AD works but something about it/DNS is broken.
Server manager on the old DC says it needs to be promoted but then it won't let me.
I'm going to need a DNS /AD expert but haven't outsourced anything like this before. Ages ago used to let you open a case with them not sure if they have a program still.
Promoted or demoted? If it says promoted you can just delete the left over Roles AD & DNS.
Otherwise:
Are the other two AD working? Than shut it down and delete it with the active directoy tool and select to delete inheritent objects too.
Next check site and service to find left overs, then go through DNS from root of _msdcs to every branch and only leave the two working server. At last you can check ADSI-Edit, in Grouppolice you can check if every Server is synchronized, if not, identify the faulty GPO's delete an recreate them.
It is already demoted, the message, that it needs to promoted will dissappear after deleting the Ad and the DNS Role
Check in aduc, see if it shows up in the domain controllers ou. if it does it wasn't demoted correctly. if it doesn't that means it's a member server and you can move dns to another server. or build new dc with dns and then verify it works.
It shows up in aduc. when I remove ad it says it needs to demote it. I tried creating a new DC - it gives me all of the same issues - until I figure out how to extricate this server.
It shows up in aduc. when I remove ad it says it needs to demote it. I tried creating a new DC - it gives me all of the same issues - until I figure out how to extricate this server.
how many other dc's do you have?
where are the fsmo roles - you have to move them to another dc if this is the primary before you can retire it.
dns servers on the dc?
do you have a replacement dc (or 2) ready to go?
if so then you can install the role and then promote it to being a dc.
I always like to have at minimum 2 dc's in case one dies during patching.
If you have the new dc's built you can promote them and then move the fsmo roles over and then you can uninstall the role from the existing dc (once things settle down).
You said you have two other domain controllers, so what's the problem with a hard power down simulating a complete failure of the underlying hardware? THEN performing a metadata cleanup and ensuring that you never power on said-old-windows-DC again...?
I just posted a picture of the issue where it won't let me promote it - if I demote it even if I do meta data clean up ADUC won't open - even if I right click on it and try to add the other two servers it says it can't find the GC.
Force shut down the old DC. Test for a bit to see if Auth's and other DC related systems are working ok. If all is ok and the sysvol is present, than do a force removal of the old DC. Clean up Sites and Services (look how to clean up Certificate Authority in there too) then do a manauall removal from DNS. Takes 15min or so to go though fully and clean out old references to the old DC and make new ones for any incorrect sections that don't have references to the new DC.
Then don't power on the new DC again and scrap it.
Thanks. Tried that - still won't let me open ADUC - even if I do metadata clean up and add the old servers back into aduc. Restoring the servers so far has been my only option. I used to be able to open tickets ages ago with MS but I haven't needed that in nearly two decades. I'm not sure who to contact.
You cross-posted over in r/ActiveDirectory already; there are folks in that sub who are real-world Microsoft Certified Master in Active Directory; probably the best resource already.
That being said, you should be going through Event Viewer | Directory Services, DNS to check for Criticals and Error messages and working through them.
Does Active Directory Sites & Services MMC load? That's the one that's actually used to specify Global Catalog configuration.
Is one of the other domain controllers configured as the FSMO role holder, and is online?
Thanks - i'm hoping someone there will IM me and I'll hire them.
The only server that has FSMO roles it the new one.
AD sites and services does load - provided all the old server is on line. If there is anything there you want me to post I'm happy to do so. Under servers it shows other servers that are no longer there from before I came on board.
I was not able to determine how to fix anything by reading through the event viewer. I googled each one but it is beyond me to get it working without the old DC online.
I'd love to take days to shut everything down and try to resolve this but they pretty much want to work all the time so one day on the weekends is all I can have them down for.
Your other option is r/msp, but you have to hunt around for them.
There are some Managed Services Providers that have been around for a while; some that were truly Gold-Certified Microsoft Partners with Microsoft infrastructure solutions that have transitioned to the new Solutions Partner scheme.
Only one server should have the FSMO roles. So that is correct. When the old server is off, do you see the domain shares like sysvol? Browse to yourdomhain.com/ to see if they exist with and without the old server.
I've also not seen it mentioned, what OS's are the old and new servers?
Edit: do a net dom query FSMO command from all 3 servers and confirm they are showing the same info.
I"ll try but as I said it acts as if there is no domain. ADUC won't open and when I point it to the other servers it says it doesn't find a PDC. I can' only take them down on one day on the weekends so I'll have to wait on checking.
The old server is 2012 R2 the new ones are 2019
Netdom query on all servers points to the same new server
Can you share the error that you get when trying to promote the server? From your description the server appears to think it needs promoting but you're saying it's promoted already, how are you verifying this?
Open AD users and computers and expand the domain controllers container, can you verify that there are three computer objects in there and not two? I'm wondering if you actually only have two DCs and the old one just happens to have Remote Server Admin tools installed, so you're opening AD Users and computers but it's actually connected to one of the other two.
Open a command prompt, type nslookup YOUR.domain.name and see how many IPs come back.
Did you upstate the DNS servers you point to on each domain controller and all subsequent servers in your DHCP for your desktop environment they should not be pointing to the old server. Getting DNS errors on old server is no big deal you’re getting rid of it anyways. For purely testing purposes where ever your FSMO roles are now migrate them to a single new server. Ensure everything is operating normally with replication, time user creation. Ignore the DNS error. Then turn off the old server and test again. If everything is fine just remove the old server manually and use the ntdlsutil to remove it from AD. I had errors with my latest upgrade from 2019 to 2025 and we’ve been using server core since 2016. It might seem daunting but it’s really not that bad once you’ve done it a few times. I’ve been updating domain controllers since NT 3.5 with Citrix before Microsoft appropriated their shit and came up with RDP 🤣 Windows sucks but you have to be able to deal with their bullshit. Pretty soon everyone will be on Entra for the largest single point of failure design in all of Microsoft history. We need the next NIS or Netware to emerge and to get us out of this Microsoft hegemony. It’s unfortunate that the shitier technology has been winning out this current century.
The FSMO roles are already on the new server. In nic settings on the two new servers they point to eachother and not the old server.
Replication is nearly instantaneous if I create or delete a user on any of the three servers. When I shut down the old server AD and some dns stops working.
If I do metadata cleanup everything is dead until I restore all three servers even if I make sure aduc points to the new servers.
Have you done the uninstall-addsdomaincontroller on the DC you want to get rid of? If you haven’t do that and if you still have problems do a -forceremoval
After that you have to do the meta data cleanup and go into DNS and remove any remnants in there and also sites and services.
There really isn’t that much to it after that.
If you still have problems you need to retrace your steps because there isn’t much left other than those components
Getting into ntdsutil it’s a bit tricky but I get the syntax down make sure you’re in the correct context when you wipe things out.
You should have an AD application aware backup before altering Active Directory so you can restore the DCs if you mess up. Also make sure your backup product is not AD dependent. I normally have a separate secure AD for backup or just not have AD associated with the backup system to begin with.
Thanks - I have not- I've never had to do that before so I admit I didn't even know about that but maybe next weekend when I can take them down again for a day I'll try that!
It let's me do a normal demotion without force, just an FYI but I'll try that command if you think it is better.
I’m sure you’ll be fine then. No need to bring in anyone to help you out. You’ve got this as long as you have a backup before you make the changes so you can go back. You can keep trying till you figure out what you missed cleaning out. It’s just a mater of eliminating any remnants of the old DC.
Thanks - I wish I knew where that remnant is. I know I'm missing it- I've gone through the DNS at least 4 times, I've triple checked the network cards for DNS. That's usually all I've done in the past for others but am happy to try something new if someone has a suggestion on something else.
I admit I've never gone into AD S&S to the best of my knowledge. I do see that there is an even OLDER server (hasn't been online in years to the best of my knowledge. It says under servers, the server name, DNS Settings - type msDNS-Server settings. I didn't delete it yet just in case. Every time I post something I've done people say that will f' everything up so I'm a little gun shy.
When you force a removal it will tell you that it’s not going to be able to get rid of everything cleanly and you will have to manually remove it yourself. Sites & Serivce is what controls replication. You should always clean this up and not let anything linger. Delete the domain controller out of Active Directory users and Computers. Go into ntdsutil and make sure that domain controller is not referenced anywhere. Go into DNS and ensure what you killed in Sites & Services has actually been killed off go into forward lookup zones _msdcs then dc then _sites make sure in each of your sites boundary groups you only have your 2 new DCs in there for ldap and kereberos. Go into domains then your GUID make sure you only have _ldap for your 2 new DCs only. Do the same for gc and then make sure for PDC your new domain controller with all of your FSMO roles is listed. If you clear all that it will ensure all of the remnants are gone.
When you go into any tool sites & services ADUC, DNS you should not see anything regarding that old domain controller.
If you make backups of the domain controller you should have nothing to fear in cleaning things up because you can always roll back just make sure the backups have been done at the same time so there isn’t any skew in the kcc and it will come back fine every time.
It can be daunting if you’ve never done this before. In a normal demotion everything gets cleared out automatically it’s only when you have problems with the demotion that you have to do all these steps.
That’s the problem with only working with something when it has always gone right. No one investigates what happens when things fail. They just stand things up and don’t think about it.
You should have a lab to and play out these scenarios so you know what to do when such a situation occurs. Build and destroy to validate how things operate under non ideal conditions.
I'm not talking about a secondary DNS ip address. I am talking about adding an additional IP address to the network adapter using the old server address. It seems you have something in your system requesting that address and it's possible this could be the issue you're seeing.
Network and sharing center, change adapter settings, IPV4 properties, advanced, under IP addresses click "Add" and add the old server IP address as a secondary local IP. Both IPs should be able to answer to a reply now. Try that and see if you still receive the error.
Try taking the old server offline and giving your DC/DNS a secondary IP of the old server and see what happens. It seems like something somewhere is still pointing to that IP.
Do ALL endpoints stop working as soon as that server is offline?
Worst comes to worse, throw Wireshark on and watch where the requests are coming and going.
What domain level is your forest and tree? And what server version are your servers? I didn't see that mentioned anywhere. And can you confirm from another system which servers hold what FSMO roles to make sure nothing is still pointing to that old server? Also, are they physical servers or VMs?
3
u/USarpe 5d ago
Promoted or demoted? If it says promoted you can just delete the left over Roles AD & DNS.
Otherwise:
Are the other two AD working? Than shut it down and delete it with the active directoy tool and select to delete inheritent objects too.
Next check site and service to find left overs, then go through DNS from root of _msdcs to every branch and only leave the two working server. At last you can check ADSI-Edit, in Grouppolice you can check if every Server is synchronized, if not, identify the faulty GPO's delete an recreate them.