I have an older Windows Server 2012 R2 domain controller named old-dc that used to hold the primary role. Two newer Windows Server 2016 domain controllers, new-dc1 and new-dc2, now host all FSMO roles. Replication appears healthy based on my checks.
I want to demote and shut down old-dc gracefully. In Server Manager, I left both "Force removal" and "Last domain controller" unchecked. The wizard reports that old-dc is still a DNS server and global catalog server. After continuing, it requires me to select an option to remove a DNS zone before proceeding.
No servers or workstations appear to be using old-dc for DNS, but I'm worried that removing the zone could remove it from the other domain controllers as well. What should I verify before continuing, and is it safe to select that option?
4 Answers
First confirm that old-dc is not listed as a DNS server anywhere in DHCP scopes, static network settings, or server configurations. Also verify that the DNS zone is AD-integrated and exists on the newer domain controllers. If it is only a local, non-AD-integrated zone, removing it from old-dc will not affect the other servers. Be more cautious with an AD-integrated zone, because changes to the zone can replicate through Active Directory.
Do not simply shut the machine down without planning the cleanup. Move or verify any remaining services, including DHCP if applicable, confirm DNS and the global catalog are available on the replacement controllers, and then demote it normally. The fact that replication currently works is good, but it does not by itself prove that every required role and DNS zone has been migrated.
The prompt may indicate that the old controller is hosting a DNS zone locally that the wizard does not believe is available elsewhere. Check the zone’s replication scope and confirm it exists on both newer DNS servers. Also check the event logs and run dcdiag for DNS and advertising errors. If the controller is genuinely unhealthy, you may need a forced demotion followed by Active Directory metadata cleanup, but that should be a last resort.
Make sure one of the newer domain controllers is a global catalog before demoting this server. Confirm the FSMO roles are already elsewhere, then run thorough health checks such as dcdiag and repadmin /showrepl. A clean demotion should normally work when replication and DNS are healthy; don’t force-remove it just because the wizard is confusing.
I checked the servers and workstations and none of them use old-dc for DNS. The zone appears to be replicating, so I’m still unsure whether the wizard’s removal option is local or affects the other controllers.