Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Yesterday I demoted a 2003R2 DC (but forgot to remove the DNS role), removed it from the domain, changed it's IP address and shut it down. Everything went pretty well (minus a host of authentication issues across the domain until I added the old IP for this DC to it's replacement 2008R2 DC) but I'm still seeing four SRV records in DNS for this DC. DNS is still showing _ldap SRV records for DC1, one each under:

DC1 is not listed under any other zone including _msdcs.

Can I simply delete these _ldap SRV records for the demoted DC?

share|improve this question
up vote 5 down vote accepted

This might be indicative of a replication problem in your environment. You should use repadmin and dcdiag to make sure that there aren't replication problems. If there aren't you might consider using ntdsutil to do a metadata cleanup since it sounds like the demotion might not have happened cleanly despite the wizard's completion.

In all likelihood, you are safe to just delete the offending SRV records, but they may be the tip of the iceberg for a larger problem. Better safe than sorry.

share|improve this answer
So running dcdiag on each remaining DC doesn't bring up any issues except for NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS not having Replicating Directory Changes in the ForestDnsZones and DomainDnsZones on the 2008R2 DCs. According to MS KB967482 this is expected as I don't have / plan to have a RODC and thus didn't run /rodcprep. Using repadmin with /showrepl, /replsummary and /showutdvec doesn't show anything bad (but a GUID last updated in April 2006?). I'm hesitant to run metadata cleanup as ADSS doesn't show DC1 at all (TechNet Library cc816907). So, I'll just delete them later today. – Christopher Williams Jul 18 '12 at 19:58
Yeah, sounds like it's just old records for some reason. Sort of odd that they're still there, but if there aren't any problems, then no reason to worry. – MDMarra Jul 18 '12 at 20:01

Remove them!

Let's say a client needs to locate an ldap endpoint in the Default-First-Site-Name site.

NetLogon queries its DNS server for


to acquire information about such a service. DC1 is returned, and the client tries to resolve DC1, and has to wait for the query to either timeout or return false.

Now it can start the process over, and the old records thus resulted in degraded performance ;-)

share|improve this answer

If you're not using that server for DNS and your hosts don't have to make service requests you can delete the records, or simply uninstall DNS

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.