I've recently taken on a new client, and I'm facing a tricky situation with their two domain controllers (DCs). One DC is standalone, while the other (let's call it DC2) is also handling a bunch of applications. At some point, DC2 was restored from an old backup, which has left it out of sync with the main DC (DC1), where all FSMO roles are held. The problem is that DC2 is in really bad shape—its Windows components (WinSxS and CBS) are broken, and although I can't demote it through the usual means since it's not recognized as having AD roles in Server Manager, I've tried various fixes like DISM and in-place upgrades to no avail. Meanwhile, many client PCs are still trying to pull policies from this faulty DC, although I've removed it from their DNS settings, and I can't reinstall the legacy software because the licensing servers are no longer available. I know the best long-term solution is to rebuild the server from scratch, but I'm looking for any quick fix to get this VM demoted.
5 Answers
To get rid of that DC, you'll need to perform a metadata cleanup. This will help remove the DC from your domain and buy you some time until you can rebuild the server. You can find the guide here: [linking metadata cleanup guide]. Good luck!
Honestly, a DC shouldn’t be running more than DNS, DHCP, and its FSMO roles. If it has too many apps on it due to historical growth, it's best to move those apps off. Consider demoting the DC and setting it up from scratch.
First off, shut down the VM. Then, use ntdsutil or PowerShell to remove it from Active Directory. Just make sure your primary DC is functioning well before you introduce a new one.
Quick fixes often lead to bigger issues down the line—it's a tough lesson learned. But I get it, waiting to rebuild takes time! By the way, how many computers are you dealing with in total?
There’s really no quick fix. Your best bet is to migrate your legacy software to a new VM, take down DC2 completely, and do a thorough cleanup—metadata, sites and services, DNS—and then create a new DC2. Avoid in-place upgrades for DCs; they're risky.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures