Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are currently want to demote Windows Server 2008 R2 Enterprise from being a DC. Originally, it was suppose to replace our older DC, but we have decided to keep the older one operational. Since the person who did the server is no longer with us, I am not really sure how to demote the DC.

When it was setup, we did the AD, WINS, File Server, DNS and DHCP roles. We are going to keep it as a file server and demote everything else.

I guess my question is can anyone point me to the right direction on how to do it? Is this MS guide what I need to do?

Thanks!

share|improve this question
    
Of course, the one time you run into an unexpected issue or something goes horribly wrong, would be the one time you don't have anyone around who knows AD well enough to pull your collective butts out of the fire... –  HopelessN00b Jul 18 '12 at 21:44
    
How many DCs do you have? –  Jim B Jul 19 '12 at 3:21
    
Two, this one would have been a third one (temporary anyway), the plan was to demote one of the other two. There was a long story behind why, but we decided to decommission this one instead. –  George Jul 19 '12 at 16:49
add comment

4 Answers

up vote 7 down vote accepted

Removing Active Directory (AD) from a Domain Controller (DC) in a single domain environment where there are other replica DCs is pretty easy. Be sure that the remaining DC is flagged as a Global Catalog (GC) server (visible in "Active Directory Sites and Services" in the properties for the "NTDS Settings" under the DC object). If it isn't, flag it as such, because you need at least one GC at all times.

Just be sure that the machine has as its first specified DNS server the IP address of another computer hosting a copy of the AD domain's DNS and run dcpromo.exe, taking the defaults (be sure NOT to specify that this is the last DC in the domain).

When you say "...we did the AD, WINS, File Server, DNS and DHCP roles. We are going to keep it as a file server and demote everything else.", however, you make me think that you're also looking at moving DHCP, DNS, and WINS off this machine. Removing the functionality those services provide involves some planning.

You can use the netsh dhcp server dump > dump-filename command to dump the DHCP server configuration into a text file (named "dump-filename", in this example) which can be imported onto a new DHCP server using netsh -f dump-filename.

You'll want to be sure that your DHCP scopes don't reference the DNS or WINS services provided by the machine you'll be removing the services from. You'll also want to be sure that machines with static IP configurations also don't reference these services.

You'll want to remove the WINS server from any replication configuration on other WINS servers.

Having said all this, you really should have at least two DCs at all times. Don't migrate to a configuration with a single DC.

share|improve this answer
    
WINS was decommissioned and functionality removed, DCHP server was removed as well as functionality, after dcpromo, anything needs to be done DNS before removing that role? –  George Jul 19 '12 at 19:39
    
Nope. As long as you've got other DNS server for the AD domain (preferrably running on DCs) and no machines (including itself) are using it as their DNS server you're good to remove it. –  Evan Anderson Jul 19 '12 at 19:47
    
Thank you very much! –  George Jul 20 '12 at 15:49
add comment

Microsofts technet has a whole chapter on this. One would assume they know the 'right' way of doing this. See the chapter Steps for Removing AD DS.

However, if you are not sure of what and how to do this, then consider that you are messing with the core functionality of your network. Tread carefully. Double and triple check. (Or hire someone to do this for you).

share|improve this answer
add comment

Yes, that MS guide is the "correct" way to do it. Though, heed Hennes advice and tread very carefully and/or hire an experienced consultant to do it. (Oh, and make sure you have a functional backup of your domain first.) It's pretty easy, honestly, and I could do it in my sleep (as could anyone with a lot of AD experience), but you want someone around who knows about AD in the event something goes wrong.

Now, a bit of advice that's more useful than how to do demote a DC... DON'T DEMOTE YOUR DOMAIN CONTROLLER.

It's a very bad idea to only have one (which it sounds like what would happen if you demoted it). Having a second around provides redundancy and allows you to actually do things on your DCs (patches come to mind) without having downtime.

Also, why do you want to demote this at all? In general, as a sysadmin, you shouldn't be making changes for no reason. If there isn't a good reason to do something, don't do it. Why do you want to demote this DC, and what do you think you'll gain from doing it? I'd bet that even if this goes off smooth as silk, you'll be putting yourself in worse position than if you hadn't done it all, which should be plenty of reason to reconsider this action.

share|improve this answer
    
+1 for that. Sounds like they've decided to put the new shiny hardware to use elsewhere (Hyper-V perhaps, since the server is running 2008 Enterprise they are also licensed for four virtual copies running on the hardware). If that is the case then it might be worth bringing up a virtual DC at the very least to give some redundancy. –  Chris McKeown Jul 18 '12 at 22:09
    
One sure hopes they have a good reason (like the one you mention) for wanting to demote the DC, but the bit about keeping it as a file server makes me wonder... and I've seen so much insanity and general WTF in small environments that I don't even assume basic rationality when I hear about a small environment anymore. –  HopelessN00b Jul 18 '12 at 22:16
add comment

STeps for a working installation of domain controller on windows Server 2008 R2:

Step1: After Installing the 64 bit version installer the Role Active Directory domain controller with the Server Manager

Do not install the DNS function!! important!!

step2: Start dcpromo.exe from the terminal. Follow the instructions Importtant a new domain must be like : xy.xy.com !!!

Then restart and the domain controller will work ... I hope this will help many users ... best regards franz

share|improve this answer
1  
This doesn't really answer the question. –  Andrew B Apr 4 '13 at 21:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.