3

We have a single server setup at a remote office and we're moving away from AD. To facilitate this move, I'm replacing the old Win2k3 AD DC with a new Win2k8r2 AD DC running on an ESXi host. This step was taken to keep from having to P2V an AD DC.

The process of building the 2008r2 box, adding it to the domain, and transferring the FSMO roles has already been completed. Right now, I am just letting the two boxes sync everything before I move on.

The old win2k3 DC contains a custom application that consists of a database and a GUI front-end that users RDP into the server to use. This application has a rather convoluted set of directory permissions scattered all over the machine to make it work and these permissions are based on AD.

Once I remove AD from this server, what happens to the directory permissions? User accounts? Etc.?

Before anyone asks, we intend to completely remove AD from the entire network. The new DC was only provisioned so that we could P2V the old machine and continue running the custom database/GUI for clients.

3
  • 2
    So your application requires AD, and you're removing AD...this sounds like a recipe for disaster. Dec 26, 2013 at 17:14
  • 3
    I'm more curious about the fact that normal users RDP into a DC to run a custom client app.
    – TheCleaner
    Dec 26, 2013 at 17:24
  • If you are moving away from AD? Why are you putting in another AD server? If you plan on running AD you will not have to worry about permission changes if you properly add the server, upgrade the forest, promote the new server and demote the old server. Dec 27, 2013 at 2:18

1 Answer 1

5

Once you remove the entire AD forest, those accounts will no longer exist, and any ACL entries that referenced domain accounts that are still applied to files and folders will now be unresolvable and appear as "Unknown" and/or just look like SIDs (S-1-5-21-blahblahblah) instead of actual account names. Those ACL entries will still be there but will be effectively meaningless because the accounts that had those SIDs no longer exist.

If you remove AD from one domain controller but another still exists, that will be fine, as the demoted DC will simply start using the extant DC and DsCrackNames and file access will still work as usual.

2
  • +1 - and I think the edit/final sentence is what he was looking for.
    – TheCleaner
    Dec 26, 2013 at 17:23
  • Thank you Ryan. Based on the responses to my original post, I was not clear on the goal. The goal was to demote that machine and spin up a new one to be the DC- this is done. Additionally, and this also lacked clarity, I wanted to know what would happen if AD was to disappear and how it would impact accounts on that machine (the demoted DC)- now I know.
    – jasonsfa98
    Oct 1, 2014 at 15:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .