Using the Ntdsutil utility to remove the only (tombstoned) DC along with an orphaned child domain

Question

Hello experts,
before working on a server consolidation project for a new customer the situation was:
Headquarter (I will not mention file and application servers)
==================================================
- One physical server running Windows Server 2003 R2 Standard Edition acting as a Domain Controller and Global
Catalog, holding the Five FSMO roles and running Microsoft Exchange Server 2003.
==================================================
Branch office (connected to the corporate office by using a persistent site-to-site VPN)
==================================================
- One physical server running Windows Server 2003 R2 Standard Edition acting as a file server and a Domain Controller
in a child domain. Before we started work on the server consolidation project, this Domain controller at the remote site already was tombstoned.
==================================================
After working on the server consolidation project the situation is:
Headquarter
==================================================
- We have added a new VM running Windows Server 2003 R2 Standard Edition acting as a Domain Controller.
- We have added a new VM running Windows Server 2008 R2 Standard Edition running Exchange 2007 Service Pack 3
and successfully migrated Exchange 2003 to 2007. We are ready to remove Exchange 2003 from the old physical server running Windows Server 2003 R2 Standard Edition.
==================================================
Branch office
==================================================
- We have added a new VM running Windows Server 2003 R2 and promoted it to be a new Domain Controller in a new
forest.
- We have turned off the tombstoned Domain Controller after migrating the applications and users to the new domain.
We haven't tried to demote it gracefully because it is totally screwed up
==================================================
In order to decommission the two remaining physical servers (the one acting as a Domain Controller and Global
Catalog, holding the Five FSMO roles and running Microsoft Exchange Server 2003 in the Headquarter and the tombstoned Domain Controller in the Branch office) our plan is to:
==================================================
1. Use the Ntdsutil.exe utility to manually remove the tombstoned Domain Controller in the Branch office.
2. After manually removing the tombstoned Domain Controller in the Branch office (step above), use the Ntdsutil.exe utility
to manually remove the orphaned child domain from Active Directory.
3. Transfer the role of the global catalog and all FSMO roles to the new VM we have added in the Headquarter (It is already
acting as a Domain Controller).
4. Remove Exchange 2003 from and gracefully demote the old physical server running in the Headquarter. ==================================================
Does our plan above make sense to you ? Can someone please explain or provide instructions for step 1 & 2 above ?
I would be very grateful if someone could kindly share some thoughts.
Any help/information will be greatly appreciated.
Regards,
Massimiliano

Answer 1

To remove an orphaned child domain: http://support.microsoft.com/en-us/kb/230306
To do a metadata cleanup: https://technet.microsoft.com/en-us/library/cc816907%28v=ws.10%29.aspx
Your plan is okay. Just make sure that your DCs are in healthy state and AD replication is fine using
dcdiag and repadmin commands before proceeding with demoting. Also, take system state backups before proceeding.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile
Hello Ahmed,
thank you for your reply to my question.
I have analyzed the replication status for all domain controllers in the Active Directory forest using the Active
Directory Replication Status Tool (ADREPLSTATUS). All DCs are in healthy state and AD replication is fine.
The only replication errors shown in the Active Directory Replication Status Tool are those involving the tombstoned
Domain Controller in the Branch office, so I think it should be safe to go ahead.
It is my understanding that before removing the orphaned child domain I should remove the tombstoned Domain Controller
in the Branch office. Can I refer to the instructions on the following webpage:
==================================================
http://www.petri.com/delete_failed_dcs_from_ad.htm ==================================================
Thank you,
Massimiliano