Cleanup after manually removing a DC

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I am running W2K SP4 domian.

I have a DC that I want to replace. On the server I want to replace I moved
all the roles to a different DC, removed DNS WINS GC and DHCP (all of which
I had on another server).

Dcpromo would not remove the machine from the domain. It asked for different
credentials. No matter what I typed for username and password it would not
demote the DC. I tried two different accounts that were in Enterprise Admins
but it would not demote.

I disconnected the DC I wanted to remove from the domain from the network
and followed the directions in Article ID 216498 (How to remove data in
Active Directory after an unsuccessful domain controller demotion).

My domain is working fine, no errors in event logs or anything like that.

If I export with ldifde I see stuff like this...

dn:
DC=..SerialNo-mydcservername.cfps,DC=138.10.in-addr.arpa,CN=MicrosoftDNS,CN=System,DC=cfps
changetype: add
dnsRecord:: CAAAAAUAAAAgAAAAAAAAAAAAAAAAAAAA5qqWs2CrxgE=
dNSTombstoned: TRUE
dc: ..SerialNo-mydcservername.cfps
instanceType: 4
distinguishedName:

DC=..SerialNo-mydcservername.cfps,DC=138.10.in-addr.arpa,CN=MicrosoftDNS,CN=System,DC=
cfps
objectCategory: CN=Dns-Node,CN=Schema,CN=Configuration,DC=cfps
objectClass: dnsNode
objectGUID:: GP1HEQThDEOPXvUlH7xlFg==
name: ..SerialNo-mydcservername.cfps
showInAdvancedViewOnly: TRUE
uSNChanged: 55447
uSNCreated: 24024
whenChanged: 20060719182805.0Z
whenCreated: 20060504003429.0Z

dn: CN=Builtin,DC=cfps
changetype: add
cn: Builtin
creationTime: 125425691599103296
domainReplica: mydcservername

I found this on the Net.

***
A DNS object is just like any other AD object... There is a slight
difference though

When a DNS object is deleted it is NOT AD tombstoned right away like other
objects and it is also not "moved" to the Deleted Objects container of the
naming context it resides it. Unlike any other objects it is invisible in the
DNS GUI and it remains in the location for the DNS Tombstone Lifetime (don't
know what the default is). When it is DNS tombstoned the attribute
dNSTombstoned is set to TRUE. After the DNS Tombstone Lifetime it is AD
tombstoned and "moved" to the Deleted Objects container of the naming context
it resides it.

If the DNS object is "recreated" within the DNS Tombstone Lifetime the old
DNS tombstoned object is revived (same GUID) as the attribute dNSTombstoned
is set to FALSE .
****

Now, I want to replace the DC that I removed with newer hardware.

Can I add the new DC with the same name, IP address and services without
problems?

Is this GUID thing true? Wouldn't be a REALLY BAD thing to use the same GUID
for my new DC?
 
if I'm not mistaken you have a single lable DNS domain name...

why? because the distinguished name of the configuration partition is:
CN=Configuration,DC=cfps

it should be AT LEAST like:
CN=Configuration,DC=cfps,DC=SOMETHING
see: http://support.microsoft.com/kb/300684/

by the way, the DNS tombstone thing is true....

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
 
I am very familiar with that article.

Can I set up the new DC with the same IP and name as the one that was removed?
 
CFSD said:
I am very familiar with that article.

Can I set up the new DC with the same IP and name as the one that was
removed?
Click to expand...


Generally, Yes.

(I am coming in late on this thread and don't have the ealier
messages):

You may not even need to manually remove the DC in that
case.

Worst case you can remove the dead DC and then the name
is certainly available.

Make sure you start (removal) with NTDSUtil -- those that
try to use ADSIEdit initially almost always make a mess.

More info:

NTDSutil metadata cleanup

Search Google for:

[ NTDSutil "metadata cleanup" remove DC Domain ]

No need to add either site:microsoft.com OR microsoft:
since the NTDSutil and other terms make it Microsoft specific
by itself.

Unless you WISH to restrict answers to the site:microsoft.com
for some reason.

[ NTDSutil "metadata cleanup" remove DC Domain site:microsoft.com ]

Key points to NOTE when doing the metadata cleanup:

You CONNECT to a WORKING DC.
You SELECT the missing/dead DC or DOMAIN

'Connect' and 'Select' are technical terms in this context.

216498 - HOW TO Remove Data in Active Directory After an
Unsuccessful Domain Controller Demotion (2000 & 2003):
http://support.microsoft.com/?id=216498
 
I did all that. It went well. What about the guid issue? Can I use the same
server name even if it uses the same guid?
--
Brett


Herb Martin said:
CFSD said:
I am very familiar with that article.

Can I set up the new DC with the same IP and name as the one that was
removed?
Click to expand...


Generally, Yes.

(I am coming in late on this thread and don't have the ealier
messages):

You may not even need to manually remove the DC in that
case.

Worst case you can remove the dead DC and then the name
is certainly available.

Make sure you start (removal) with NTDSUtil -- those that
try to use ADSIEdit initially almost always make a mess.

More info:

NTDSutil metadata cleanup

Search Google for:

[ NTDSutil "metadata cleanup" remove DC Domain ]

No need to add either site:microsoft.com OR microsoft:
since the NTDSutil and other terms make it Microsoft specific
by itself.

Unless you WISH to restrict answers to the site:microsoft.com
for some reason.

[ NTDSutil "metadata cleanup" remove DC Domain site:microsoft.com ]

Key points to NOTE when doing the metadata cleanup:

You CONNECT to a WORKING DC.
You SELECT the missing/dead DC or DOMAIN

'Connect' and 'Select' are technical terms in this context.

216498 - HOW TO Remove Data in Active Directory After an
Unsuccessful Domain Controller Demotion (2000 & 2003):
http://support.microsoft.com/?id=216498


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]
Click to expand...
 
CFSD said:
I did all that. It went well. What about the guid issue? Can I use the same
server name even if it uses the same guid?
Click to expand...

Once the DC is removed that GUID is no longer in use.

DCs use the SID of the Domain and the GUID doesn't
seem to matter (always?) if the old DC is removed physically
and another is installed with the same name.

But it isn't an issue if you deleted the old DCs references.
 
Back
Top