I have an old Windows Server 2012 R2 domain controller named old-dc that I want to demote and shut down. Two newer Windows Server 2016 domain controllers, new-dc1 and new-dc2, are still active. All FSMO roles have already been moved to new-dc1, and replication appears healthy according to repadmin.
When I start the demotion wizard on old-dc, I leave both "Force removal" and "Last domain controller" unchecked. The wizard warns that the server provides DNS and Global Catalog services. After continuing, it presents an option to remove the DNS zone, and I cannot proceed without making a choice.
No servers or workstations are using old-dc as their DNS server, but I am concerned that removing the zone here might delete the Active Directory-integrated DNS zone from the other domain controllers as well. What should I verify before proceeding, and is it safe to remove the zone during demotion?
3 Answers
Before demoting it, make sure at least one of the newer domain controllers is also a DNS server and Global Catalog. The FSMO roles being moved is important, but it does not automatically transfer the GC role. Confirm DNS resolution, replication, and directory health with tools such as dcdiag and repadmin before proceeding.
If the normal demotion wizard cannot communicate reliably with the other domain controllers, be careful about forcing removal. A failed or forced demotion requires metadata cleanup afterward and can leave stale DNS or Active Directory objects. Since repadmin shows replication working, investigate the DNS zone and run additional health checks rather than immediately forcing the removal. Also plan an upgrade path beyond the older 2016 servers when practical.
First verify that no clients, servers, DHCP scopes, or statically configured devices still use old-dc for DNS. Also confirm that the DNS zone is Active Directory-integrated and exists on the remaining domain controllers. Removing the local DNS service or its copy of an AD-integrated zone during demotion should not remove the replicated zone from the other domain controllers, but you should still confirm the zone and DNS records are present elsewhere.
I checked the servers and workstations, and none of them use old-dc for DNS. My main concern was whether the wizard would remove the zone from the other domain controllers too.
The FSMO roles are already on another server, and repadmin shows that old-dc is replicating. I will verify the GC role and run more health checks before deciding whether a normal demotion is safe.