Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a old DC that was never properly demoted and I no longer have access to it (it's offline) I followed this guide to remove the DC from AD: it has worked before but for this server I am getting the following error:

LDAP error 0x32(50 (Insufficient Rights).
Ldap extended error message is 00000005: SecErr: DSID-03151D15, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

I get this error when I try to remove the server with the following command: Remove selected server

Any ideas how to remove all references to this DC?

share|improve this question
oops forgot to say this is a single forest with multiple domains. I was logged in as DC admin – evolvd Aug 17 '11 at 18:05
Expand on exactly which user you were logged in as; the Administrator local-ish user for a domain controller is only available in directory services restore mode; did you mean the domain's default Administrator account? – Shane Madden Aug 17 '11 at 18:08
It is the domain administrator account – evolvd Aug 17 '11 at 18:23
+1 @Shane . Also where in the process are you getting this error message? Metadata cleanup has you doing a lot. Also, here's the official Microsoft link to it – Nixphoe Aug 17 '11 at 18:24
I get this error when I try to remove the server with the following command: Remove selected server – evolvd Aug 17 '11 at 18:34

Can you add the full error details please? Normally you'd get some details of which object it had issues removing and a FQDN. You can sanitise the path and replace domain parts as you want. For the failed objects, check that the permissions on the object allow that user to delete it. basically you are deleting a series of objects in domain partition and config partition. You need to see which object couldnt be deleted and the permission on the object. ldp.exe or adsiedit.msc is recommended for reviewing permissions.

share|improve this answer
up vote 0 down vote accepted

There was special permissions missing from the administrator account. Once they were added back in the server was able to be removed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.