up vote 1 down vote favorite
share [g+] share [fb]

I have a old DC that was never properly demoted and I no longer have access to it (it's offline) I followed this guide to remove the DC from AD: http://www.petri.co.il/delete_failed_dcs_from_ad.htm it has worked before but for this server I am getting the following error:

LDAP error 0x32(50 (Insufficient Rights).
Ldap extended error message is 00000005: SecErr: DSID-03151D15, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

I get this error when I try to remove the server with the following command: Remove selected server

Any ideas how to remove all references to this DC?

link|improve this question
96% accept rate
oops forgot to say this is a single forest with multiple domains. I was logged in as DC admin – evolvd Aug 17 '11 at 18:05
1  
Expand on exactly which user you were logged in as; the Administrator local-ish user for a domain controller is only available in directory services restore mode; did you mean the domain's default Administrator account? – Shane Madden Aug 17 '11 at 18:08
It is the domain administrator account – evolvd Aug 17 '11 at 18:23
+1 @Shane . Also where in the process are you getting this error message? Metadata cleanup has you doing a lot. Also, here's the official Microsoft link to it technet.microsoft.com/en-us/library/cc736378(WS.10).aspx – Nixphoe Aug 17 '11 at 18:24
I get this error when I try to remove the server with the following command: Remove selected server – evolvd Aug 17 '11 at 18:34
feedback

2 Answers

up vote 0 down vote

Can you add the full error details please? Normally you'd get some details of which object it had issues removing and a FQDN. You can sanitise the path and replace domain parts as you want. For the failed objects, check that the permissions on the object allow that user to delete it. basically you are deleting a series of objects in domain partition and config partition. You need to see which object couldnt be deleted and the permission on the object. ldp.exe or adsiedit.msc is recommended for reviewing permissions.

link|improve this answer
feedback
up vote 0 down vote accepted

There was special permissions missing from the administrator account. Once they were added back in the server was able to be removed.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.