Failed / Unable to Delete /Remove Domain Controller from Active Directory?Use NTDSUTIL

Unable / Failed to Delete /Remove Domain Controller from Active Directory? no Worry  You can remove using NTDUTIL.

When you try to remove a domain controller from your Active Directory domain by using Dcpromo.exe and fail, you will be left with remains of the DCs object in the Active Directory. As part of a successful demotion process, the Dcpromo wizard removes the configuration data for the domain controller from Active Directory, but as experienced, a failed Dcpromo attempt might leave these objects in place.

Incase you give the same name the new domain controller as the failed computer, then you need perform only the first procedure to clean up metadata, which removes the NTDS Settings object of the failed domain controller. If you will give the new domain controller a different name, then you need to perform all three procedures: clean up metadata, remove the failed server object from the site, and remove the computer object from the domain controllers container.

Before execute the process, make sure that you use an account that is a member of the Enterprise Admins universal group.

Warning: Using the Ntdsutil.exe utility incorrectly may result in partial or complete loss of Active Directory functionality. I do not take any responsibility of your loss or damage if occurs to follow this documents since this document based on my experience and knowledge.

How to Use the Metadata Cleanup using NTDSUTIL.exe.

1. At the command line, type Ntdsutil and press ENTER.
2. At the Ntdsutil: prompt, type “metadata cleanup” and press ENTER.
3.  At the metadata cleanup: prompt, type connections and press Enter.
4. At the server connections: prompt, type connect to server <servername>, where <servername> is the domain controller (any functional domain controller in the same domain) from which you plan to clean up the metadata of the failed domain controller. Press Enter.
5. Type quit and press Enter to return you to the metadata cleanup: prompt.
6. Type select operation target and press Enter.
7. Type list domains and press Enter. This lists all domains in the forest with a number associated with each.
8. Type select domain <number>, where <number> is the number corresponding to the domain in which the failed server was located. Press Enter.
9. Type list sites and press Enter.
10. Type select site <number>, where <number> refers to the number of the site in which the domain controller was a member. Press Enter.
11. Type list servers in site and press Enter. This will list all servers in that site with a corresponding number.
12. Type select server <number> and press Enter, where <number> refers to the domain controller to be removed.
13. Type quit and press Enter. The Metadata cleanup menu is displayed.
14. Type remove selected server and press Enter.

    

    Server Names Demo Purpose Only -(c)Anil Parashar

                  (You will receive a warning message. Read it, and if you agree, press YES.). 

Active Directory confirms that the domain controller was removed successfully. If you receive an error that the object could not be found, Active Directory might have already removed from the domain controller.

  16. Type quit, and press Enter until you return to the command prompt.

To remove the failed server object from DNS

1. In the DNS snap-in, expand the zone that is related to the domain from where the server has been removed.
2. Remove the CNAME record in the _msdcs.root domain of forest zone in DNS. You should also delete the HOSTNAME and other DNS records.
3. If you have reverse lookup zones, also remove the server from these zones.

Other negotiations.

Also, careful the following:

ü  If the removed domain controller was a global catalog server, evaluate whether application servers that pointed to the offline global catalog server must be pointed to a live global catalog server.

ü  If the removed DC was a global catalog server, evaluate whether an additional global catalog must be promoted to the address site, the domain, or the forest global catalog load.

ü  If the removed DC was a Flexible Single Master Operation (FSMO) role holder, relocate those roles to a live DC.

ü  If the removed DC was a DNS server, update the DNS client configuration on all member workstations, member servers, and other DCs that might have used this DNS server for name resolution. If it is required, modify the DHCP scope to reflect the removal of the DNS server.

ü  If the removed DC was a DNS server, update the Forwarder settings and the Delegation settings on any other DNS servers that might have pointed to the removed DC for name resolution

  I Anil Parashar do not take any responsibility of your loss or damage if occurs to follow this documents since this document based on my experience and knowledge.