Decommissioning a domain controller - Possible Scenarios

Hello,
I am in the process of upgrading my window server 2003 to 2012 R2.
I have introduced a swing DC,installed 2012 on it,ensured that replication is occuring between the two and succesffully transfered the roles from the old DC to the new temporary 2012 DC.
Refer to this thread for the procedures in use
http://social.technet.microsoft.com/Forums/en-US/1c742612-ff44-4521-bb68-53b17b287fae/upgrade-domain-controller-from-windows-server-2003-sp2-to-windows-server-2008-or-2012?forum=winservergen
Now i intend to decommission the old 2003 server , and to a fresh reinstallation of 2012 in it,then once i ensure replication has occured, transfer back the roles and decommission the swing DC
Both server are global catalogs..
My question is this, Do i just do a fresh reinstallation of the 2012 on the old server 2003 without first demoting it? or do i demote it ,test and then install 2012 on it...
Since the servers are GC both,is there a possibility that when i demote the old DC the DNS,AD details that had replicated dissapears?
What any other cautions should i check?
Thanks

Hello,
demotion is ALWAYS required except you do in-place upgrades which is not recommended on DCs.
If you don't do a correct demotion, also removing it from AD UC after removing the server complete from the network, checking DNS zones and zone properties and Name server tabs and removing the DC from AD sites and services (not done during demotion),
you may run into trouble when installing a new DC with the same name and also have always replication errors as the AD database doesn't know that the DC is removed correct.
With a not correct demoted DC AD metadata cleanup is required.
BEFORE demoting the old OS machine ASSURE that the enw DC has also the NETLOGON and SYSVOL share available and they contain the same content as on the old DC.
Also the new DC MUST become DNS server if you don't have any domain member server that handles DNS zones.
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://msmvps.com/blogs/mweber/
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

Similar Messages

How to find which devices are still using affected domain controller

Hi Everyone,
We have a 5 Domain controller's in a Site. And we are going to decommisson one of our affected DC in a site.
Can you please let me know how to find the log files to see which devices are still using this domain controller.
Regards,
Neel kamal
Neel kamal

Neel,
From strictly an Active Directory perspective, there is nothing special you need to do to decommission a domain controller in a site. There are many processes that automatically balance out and recreate connections as needed without any user intervention.
The DC Locator process will automatically direct clients to active domain controllers, there is nothing you need to do here.
What you need to be concerned with are things like the following:
DNS - Are you running AD integrated DNS and is the DC you are decommissioning hosting that roll - if so, is it the ONLY DC in the
site that is running DNS? You'll need at least one in the site.
DHCP server - Is the DC you are demoting a DHCP server? You'll need to account for that.
Global Catalog - Is the DC you are demoting a Global Catalog server? You'll need at least one in the site.
File Shares - Is the DC hosting any files shares? You'll need to move those and make sure you redirect your clients.
Was this DC a set as a Preferred Bridgehead Server? You'll need to undo that first.
Those are the big ones that come to mind. Decommissioning a DC is easy if you have prepared properly. The others that have replied have offered some great advice which you should follow. Do your homework and you should be fine.
Hope that helps
Gary
Gary G. Gray
MCP, MCTS, MCITP, MCT Alumni
Please remember to mark the replies as answers if they are helpful.
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

¿Is it possible to upgrade from SCCM 2012 a domain controller in Windows Server 2008 R2 TO 2012 R2?

Hi all.
I want to know if is it possible to upgrade a domain controller from Windows Server 2008 r2 to 2012 r2 installing from SCCM 2012.
Thanks.
Regards.

Hi all.
I want to know if is it possible to upgrade a domain controller from Windows Server 2008 r2 to 2012 r2 installing from SCCM 2012.
Thanks.
Regards.
Anything is possible if you can script it. You could create a task sequence to do the following (with scripts):
1. Demote 2008R2 DC to member server
2. Remove 2008R2 member server from domain
3. Build new 2012R2 member server and join to domain
4. Promote 2012R2 member server to DC
You can do this. However, why would you? Just because you can doesn't mean you should. In my opinion it's more trouble and testing than it's worth. How many times would you need to do this?
Gerry Hampson | Blog:
www.gerryhampsoncm.blogspot.ie | LinkedIn:
Gerry Hampson | Twitter:
@gerryhampson

One Domain Controller, multiple Transport Landscapes - possible?

I would like to have ONE domain controller - configured in Solution Manager - to manage TMS configuration for ECC, BI, etc. I am looking at this domain controller to be the central point for CTS+ and ChaRM.   This means multiple Development systems and associated Quality Assurance systems.
DECC --> QECC --> PECC
DBI --> QBI --> PBI
Is this even possible?
The issue seems to be the standard '/SAP/' transport group for the 'SAP target for Default Layer'.   Is there a way to set up the standard SAP transport group to be uniquely identified in the domain controller if there are multiple SAP components supported by one domain controller?
Thanks in advance for the assistance ...

Hi Peter,
Thanks for the response.    My concern was the SAP default transport layer.   Another team member and I worked on this in more detail and I was able to successfully a specific SAP default transport layer for each of the Development systems and give each one a unique name.   I created the transport layers and transport groups and STMS accepted them, but we haven't actually used any of this yet so whether or not this is actually successful remains to be seen!    If
Regards,
Laura

Adding third domain controller - decommissioning one existing

Hello,
I would like to add a new 2012 domain controller to site A which already has a 2008 domain controller. There is also another site B with has an existing 2012 domain controller. I have a couple questions.
When I add the new domain controller to site A do I point the DNS controller to the existing domain controller in site A before promoting(that is by far the fastest link)?
When I am done adding domain controller at site A and go to decommission the existing 2008 domain controller what DNS do I point to on the new domain controller and how do I do this? Do I just put site B domain controller's\DNS IP address as the preferred
and reboot the new domain controller and do the same on site B domain controller to point it's primary DNS to the new one?
Thanks

When I add the new domain controller to site A do I point the DNS controller to the existing domain
controller in site A before promoting(that is by far the fastest link)?
Yes. After promoting it, you can refer to my recommendations about IP settings for DCs: http://www.ahmedmalek.com/web/fr/articles.asp?artid=23
When I am done adding domain controller at site A and go to decommission the existing 2008 domain
controller what DNS do I point to on the new domain controller and how do I do this? Do I just put site B domain controller's\DNS IP address as the preferred and reboot the new domain controller and do the same on site B domain controller to
point it's primary DNS to the new one?
Refer to my recommendations for IP settings.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Is it possible to restrict a local admin from accessing/viewing AD accounts on a Domain Controller?

I am working on determining if I can have a separate administrator group handle patching and performing maintenance on four servers that are DCs of their own AD domain, but restrict these administrators from the ability to see the active directory user
accounts in that AD domain?

Hello,
Since you are talking about domain controllers I have to say there are no Power Users group in them. Actually the local user management will be disabled as soon as you promote a server to a domain controller. The only option which is left here is to grant
Administrators handle the job. In case of RODC you can go through what Albert suggested.
However since domain controllers are sensitive and plays a key role in your environment I strongly recommend not to allow non administrators to perform maintanance or other related tasks (At least for domain controllers).
Another option you have left for your patch management is to use a member server like WSUS to automatically install updates on your DCs.
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Is it possible to bypass Domain Controller Promotion (dcpromo) Hard Drive Check? My Server has an embedded drive instead of a SATA port. (emmc)

I have a small computer with just an embedded drive instead of a sata port. It seemed perfect for a small domain controller, since it has 32G's which is more than enough space, and with a gigabit Ethernet, and 1.6Ghz dual core cpu, seemed more than enough
for what I needed.
Windows 2012, or Windows Server Technical Preview, both install fine on it, but when I run dcpromo to create the domain It fails on selecting the location for files. The error is that the path is not a hard drive. The machine only has USB ports so I can't
add a SATA drive just to store these logs/configs, even if I wanted to.
The actual computer I was trying to use: http://www.ecs.com.tw/LIVA/
Thanks for any help.

On the Windows Server Technical Preview,
Install-ADDSForest -SkipPreChecks -DomainName DOMAIN.CONTOSO.COM -DomainMode Win2008 -ForestMode Win2008R2 –DatabasePath "C:\Windows\NTDS" –SYSVOLPath "C:\Windows\NTDS" –LogPath "C:\Windows\NTDS\Logs"
gives me the error "No NTFS 5 drives exit." (note exit, not exist)
I'll reinstalling windows 2012 and see if I get a different message there.
This was just a standard install, so the drive is definitely NTFS.

Windows Domain Controller on Windows Server 2012 R2: Hyper-V roaming profiles not loading due to slow connection

I have racked my brain and done everything that I know to do for about two weeks now. I am setting up a new system at our fire department and I am having the worst luck with getting the workstations to login to the domain controller with roaming
profiles. It keeps telling me that the roaming profile could not be loaded because of a slow connection. These are workstations that are connected directly to the switch that the DC is connected to. I have tried multiple connections regarding
the layout (DC into the router, router into the switch). The router is a Cisco RV220W. I have two VLANS, one for public and one for private domain. The Private VLAN has DHCP turned off since I am providing it through the DC. I currently
have a connection from the Private VLAN going to the unmanaged switch that the workstations and server are plugged into.
The server is a Dell PowerEdge R420 that has 6 NIC ports (1 dual port and 1 quad port). I have a virtual switch setup on Hyper-V for an external port (let's say Card 2 Port 3) that is assigned to the WS 2012R2 Domain Controller. The DC can see
the internet fine and the workstations can connect to the shared folders on the server. I can retrieve files by just using the computer name or FQDN. The DC is also running DNS and DHCP. The DNS has the _msdcs setup from when I installed
the active directory role. I have attempted to assign static IP addresses to the workstations:
IP:                     10.0.0.80
Subnet:             255.255.255.0
IPV4 Gateway: 10.0.0.1
IPV4 DNS:        10.0.0.12
I've attempted "append the specific DNS suffix", I've "registered the connection in DNS", I've used "use this connections suffix in DNS registration".
The server is assigned:
IP:                     10.0.0.12
Subnet:             255.255.255.0
IPV4 Gateway: 10.0.0.1
IPV4 DNS:         10.0.0.12
The DNS entries have forwarders that forward to my ISP DNS servers for lookup
I've enabled and disabled DHCP, I've installed a new VM just to create another DC to make sure that I didn't goof up when I created it.
I've lost my patience with this project and am sinking fast. Can someone please offer some advice as to what I've done wrong? I've created this exact scenario at work many times but, I've never done it with Windows Server 2012. Is this
possibly something to do with the Dell PowerEdge server (Generation 12) with the SR-IOV? I am going to attempt to work on it some more tomorrow when I get over there. I think there may be an issue with the SR-IOV not being enabled on the machine
through the Dell Bios. Would the SR-IOV really cause the workstations to report a slow connection? When I login at the domain controller the roaming profiles and folder redirection work fine so, I know the GPO settings are correct. I don't
have "ignore slow connections" or any of those GPO's set. I need to get it working the correct way so, I didn't want to fool the server when there is another underlying problem. Any help that someone can offer, I am more than willing
to listen. If you need more information, please ask.
Thanks,
Jay

So, I've managed to research this some more since Thursday and I've come to the conclusion that Hyper-V does a horrible job of supporting Qualcomm NIC cards. That's the only thing I can conclude as far as where the issue is originating. I've read many
post and walkthroughs but nothing that has helped. The issue wasn't with any settings in the domain controller. The issue was that there really is a slow connection originating at the domain controller that is a VM and has network connectivity through the
virtual switch from Hyper-V. So, next question is, how do I get the DC to have better connectivity through the NIC that Hyper-V won't give it? If hyper-v would allow passthrough, this would be so much simpler. VM-ware is looking really good at this point.
Im disappointed in MS right now.

Required FSMO Roles to Bring up Domain Controller

I have an unusual situation. Our network team is moving to a new vendor for our WAN circuits and this change which has left our network split. I have 10 domain controllers which can't talk to the other seven domain controllers. This situation
will last about another 2 months.
I have been asked to bring up an RODC domain controller in a location which can't connect to the DC which hosts the FSMO roles, but has communication with seven domain controllers.
Is this possible? What FSMO roles are required to bring up a DC?
Thanks
LRL

In a worse case scenario, replication may fail between domain controllers when a WAN link is re-established:
http://pmeijden.wordpress.com/2011/01/12/domain-replication-has-exceeded-the-tombstone-lifetime/
"This can also happen when your network isn’t working properly or when replication error’s have occurred for to long without anyone noticing them. In large environments it’s possible that a complete site has been disconnected due to unavailable WAN
connections. [...]
The reason why the domain controllers will not continue the replication is because they are protected for so called Lingering Objects. For example, one or more objects that are deleted from Active Directory on all other domain controllers might remain on
the disconnected domain controller. Such objects are called Lingering Objects. Because the domain controller is offline during the entire time that the tombstone is alive, the domain controller never receives replication of the tombstone and therefor doesn’t
know that the object has been deleted."
If your tombstone lifetime is still 60 days (the original default), that is about 2 months.
You can check like this:
http://technet.microsoft.com/en-us/library/cc784932(v=ws.10).aspx
If it is 180 days (new default - I won't go into the details of how and when this changed), you may avoid the worse case scenario. But you still might have problems.
Two months... how much time has already passed?
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Restoring a Domain Controller - When other DC's are available

I'm trying to get some clarity and confidence on the proper way to restore domain controllers. here are my questions:
1. What is the proper way to restore a Domain controller into an existing Forrest where other domain controllers are present when you have a system state backup taken by Windows Server Backup?
1a. In this scenario - will i need to enter into DSRM mode prior to booting the server?
2. What is the proper way to restore a Virtualized Domain Controller into an existing Forrest where other domain controllers are present when you have a 3rd party image based backup solution that has HyperV VSS writers?
2a. In this scenario - will i need to enter into DSRM mode prior to booting the server?

1. What is the proper way to restore a Domain controller into an existing Forrest where other domain
controllers are present when you have a system state backup taken by Windows Server Backup?
You can restore the DC using two possible methods:
Method 1: Do a non-authoritative restore using a system state backup. Do not do an authoritative restore so that you do not lose recent changes here.
Method 2: If the DC is an FSMO holder then size the FSMO roles to another DC, do a metadata cleanup and then re-install the server and promote it again as a DC. If it is not an FSMO holder then simply do a metadata cleanup and then re-install
the server and promote it again as a DC.
1a. In this scenario - will i need to enter into DSRM mode prior to booting the server?
Yes. You need to get inside DSRM mode to restore the DC from a system state backup.
2. What is the proper way to restore a Virtualized Domain Controller into an existing Forrest where
other domain controllers are present when you have a 3rd party image based backup solution that has HyperV VSS writers?
You can read that: http://technet.microsoft.com/en-us/library/d2cae85b-41ac-497f-8cd1-5fbaa6740ffe(v=ws.10)#backup_and_restore_considerations_for_virtualized_domain_controllers
Also, see that about DC cloning in Windows Server 2012 and higher: http://blogs.technet.com/b/askpfeplat/archive/2012/10/01/virtual-domain-controller-cloning-in-windows-server-2012.aspx
2a. In this scenario - will i need to enter into DSRM mode prior to booting the server?
You can find the details in the links I shared.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

New Domain controller, DNS client settings before FSMO transfer

I recently promoted a new domain controller. It is the fourth domain controller and third in the site. I plan to decommission the other two domain controllers in the site leaving just the new one. Right now the new domain controller points
its tcp\ip client to the other other domain controller\DNS servers as primary and itself at the bottom. The other domain controllers point to themselves as primary and the newest domain controller on the bottom of the list. Clients on the network
use the original domain controllers as DNS from DHCP first and then the new domain controller DNS. Is it okay to transfer all the FSMO roles to the new domain controller or should I make all the DNS clients point to it first?

Hi,
It is possible to first change your FSMO roles and after this is done then point your DNS clients to the new DC. This should not be a problem.
some interesting information about assigning your FSMO Roles: http://www.windowsdevcenter.com/pub/a/windows/2004/06/15/fsmo.html
Hope this helps you out.

Renaming Windows Server 2012 Domain Controller with Exchange Server 2013

Is it possible to rename Windows Server 2012 Domain Controller, as we are using Exchange Server 2013 as a member server on Windows Server 2012 ?
We have some issues with the Domain Name, so want to rename..
Maybe somebody knows the best practices how to do this in best way???
Thanks.

Hello,
You should do the following:
1. Promote another DC.
2. Transfer FSMO roles to that server.
3. Decommission old DC.
4. Rename it.
5. Promote it again as DC.
Here is useful link:
http://technet.microsoft.com/en-us/library/cc782761(v=ws.10).aspx#bkmk_renamesingle.
Hope it helps,
Adam
www.codetwo.com
If this post helps resolve your issue, please click the "Mark as Answer" or "Helpful" button at the top of this message. By marking a post as Answered, or Helpful you help others
find the answer faster.

Potential Downtime or Damage to Exchange if I remove a second domain controller??

We have a single instance of Exchange 2010 with all roles (minus lync, communications, etc..) on a Server 2008 Standard server.
We also have a primary domain controller and a second domain controller that offers DNS and would be used in case of disaster to the primary controller.
I've noticed in the past that if the secondary domain controller is down for maintenance that the Exchange server starts having problems. A major example of this would be last year the virtual instance of the second domain controller failed and when we rebooted
the exchange server, it lost its association with the domain even though the primary domain controller was readily accessible.
We are in a spot now that we no longer need the secondary domain controller and want to decommission it. I obviously want that to go as smoothly as possible. Is there anything I should do to prevent any unwanted damages to the exchange environment?
Jonathan Strader

It doesn't seem that anyone has responded to this. The short answer is turning off the secondary server will NOT have an effect on the exchange server. HOWEVER, that is the short answer.
It WILL have an effect if:
1) the secondary server is the ONLY DNS server and the exchange server is using the secondary server for DNS queries.
2) The FSMO Roles are on the secondary server
3) The Secondary server is the only global catalog.
I know this is a lot to take in.. but it really isn't that hard. FSMO Roles and global catalog are just a piece of active directory that keeps track of users, rights, settings, that sort of thing. You need to make sure that you seize the FSMO
roles on the first domain controller.
One command you can do on the first server to check fsmo roles is:
netdom query fsmo
On a side note. This is what you can do as well to see if the secondary server has any effect on exchange. Ready? Turn off the secondary server and see if anything bad happens (People don't get their emails..) if something stops working
after you turn off the second server then turn it back again. Everything should be back to normal.
Jerry Suner

Maintain access to network(shared folders) resources if the site loses access to a Domain Controller?

Scenario
Windows 7 users log on to workstations at a site. Domain Controller is up and does the domain authentication for those users across the WAN. Users are then accessing a local(same building) Shared directory on a Windows 2008r2 server, in order to open, modify,
save new files, etc.
Then, the site loses access to the Domain Controller due to a WAN outage.
Question
Will those users that have already logged onto their Windows 7 workstations continue to have access to the shared resources on the local Windows 2008r2 server with their cached credentials(assuming they don't logoff or restart their machines)?? This has
been the case in the past, but wondering if anything has changed with Windows 2008??
Thanks

Hi,
The duration that you can access the server depends on when the server requires re-authentication.
In Windows implementation, SMB session expiration is enforced based upon the client’s support of dynamic re-authentication capability [MS-SMB].
If the client enables the CAP_DYNAMIC_REAUTH capability bit, the server will enforce session expiration. If a client does not set CAP_DYNAMIC_REAUTH, the Windows server does not return STATUS_NETWORK_SESSION_EXPIRED.
The SMB dynamic re-authentication feature was introduced in Windows XP. From there, Windows-based clients set the CAP_DYNAMIC_REAUTH capability bit to indicate to the server that the client supports re-authentication when the Kerberos service ticket for
the session expires.
Windows servers do check CAP_DYNAMIC_REAUTH:
If clientCapabilities sets CAP_DYNAMIC_REAUTH, the server will set Server. Session.AuthenticationExpirationTime to the expiry time returned by AcceptSecuirtyContext.
If clientCapabilities does not set CAP_DYNAMIC_REAUTH, the server will not set Server. Session.AuthenticationExpirationTime, basically a CAP_DYNAMIC_REAUTH capability bit not set by the client means the session will not expire on the server side.
To configure Maximum lifetime for service ticket, you can use grouppolicy. The default value of
Maximum lifetime for service ticket
in Default Domain Policy is 600 minutes.
Note:This setting is applied to DC, not clients.
For detailed information, please view the link below
CIFS and SMB Timeouts in Windows
http://blogs.msdn.com/b/openspecification/archive/2013/03/19/cifs-and-smb-timeouts-in-windows.aspx
Maximum lifetime for service ticket
http://technet.microsoft.com/en-us/library/jj852188.aspx
Hope this helps.
Steven Lee
TechNet Community Support

Server 2008 Hyper-V Failover Cluster Error on Domain Controller Reboot

I am pretty new to Hyper-V virtual but I have 2 Hyper-V Clusters, each with 2 Nodes and a SAN, 1 Physical Domain Controller for failover cluster management and 1 virtual domain controller as backup. All is running well, no issues. I installed
windows updates on the physical DC and upon reboot, got an error 5120 on cluster 2 that says "Cluster Shared Volume 'Volume1' ('Cluster Disk 1') is no longer available on this node because of 'STATUS_CONNECTION_DISCONNECTED(c000020c)'. All I/O will
temporarily be queued until a path to the volume is reestablished. It pointed to the 2nd node in that cluster as being the issue but when I look at it, it is online and all healthy so I don't understand why the error was triggered and if the DC would
go down for a failure, would that node not be able to access the CSV permanently.
Appreciate any help anyone can provide.

Hi mtnbikediver,
In theory, if you has the correct configuration of cluster the DC restart will not cause the CSV down, does your shared storage installed on your DC? Did you run
the cluster validation before you install the cluster? We strongly recommend you run the cluster validation before you build the cluster, same time please install the recommend update of 2008 cluster first.
Recommended hotfixes for Windows Server 2008-based server clusters
http://support.microsoft.com/kb/957311
I found a similar scenario issue the DC restart will effect the cluster network name resource offline, but it is for 2008R2.
Cluster network name resource cannot be brought online when one of the domain controllers is partly down in Windows Server 2008 R2
http://support2.microsoft.com/?id=2860142
I’m glad to be of help to you!
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Decommissioning a domain controller - Possible Scenarios

Similar Messages

Maybe you are looking for