Urgent; Demote W2k DC

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Dears;

when I start to demote a w2k DC it show me the following msg.

"The operation failed because: The attempt to configure the machine account
MADINEH02$ on server MADINEH01.MADINEH.aleppo.BBSF.com failed. "Access is
denied. "

Specify an account with Enterprise Administrator privileges to the forest,
"BBSF.com"
 
Hello Mhd,

So whats the problem, the solution stands in the text, be an Enterprise admin.

Best regards

Myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
 
Dear;

I am using an enterprise admin. user

Myweb said:
Hello Mhd,

So whats the problem, the solution stands in the text, be an Enterprise admin.

Best regards

Myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
Click to expand...
 
Hi MHD,

I hate it when stuff like that happens. This is usually the result of some
kind of problem with the DNS or the replication topology. To make your way
through this you'll want to attack the problem through three phases before
jumping right into it. It might take a little bit longer, but it will give
you a better solution and will act as a good pattern for future problems.

1. Triage the issue
Look at the logs and run DCDIAG and NETDIAG against the Domain Controllers
that are working in your environment. This will often point you at the issue
that caused the problem. Resolve the DNS and replication problems in the
domain at this point. This will also let you see where there are references
to the DC that you tried to add.

2. Deal with the misbehaving DC
You can try a regular DCPROMO at this point. If you ahve taken care fo the
DNS problems, it will oftentimes com out at this point. If it doesn't you do
have the option to use the /forceremove switch. Just know that you'll have
to do the metadata cleanup process, manually go through your SRV records in
your DNS and may have to pull records out of sites and services. Make sure
that the changes have replicated to all sites before you put this back in,
otherwise you might run into conflicts later.

3. Join the DC again
Get the DC into the domain as a member server. At this point you will want
to make sure that you can ping the other DCs, especially the one with the
PDCe role assigned to it. You should also ping the domain name (FQDN
format). This should return the IP address of the PDCe as well. If it
doesn't, you are headed for the same problem and will ahve to go back to
troubleshooting your DNS as well as your site/ subnet definitions. Finally,
since you had issues with the domain, you might want to go through the DCDIAG
and REPLMON reports again before adding the DC, just to be sure that there
are no other domain health issues creaping in.

Best wishes!
 
Back
Top