Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I change a domain controller to a non-domain controller? And more importantly, can it be done safely? Will this ultimately call for a repave of the machine?

I've found the dcpromo command, but wanted to get some feedback before I hose this machine.

Background. Someone set up this server by checking "all features" when installing. This server is a DNS server, Domain Controller, you name it. In practice it is use as a file share and build server.

share|improve this question
up vote 7 down vote accepted

Removing Active Directory from that server computer, assuming that you have other domain controller computers, is a straightforward process. (If it's the only domain controller in its domain or forest then you need to ask yourself some questions re: whether or not that particular domain or forest needs to exist.)

In Windows NT 4.0 you had to "repave" machines to change their role. Since Windows 2000 it's been much easier.

(If you've installed SQL Server 2005 on the machine already there can be some minor issues that will need to be addressed after the demotion. Assuming you have not, proceed.)

  • Start / Run / dcpromo
  • You will be prompted to remove Active Directory. Take default choices throughout the domain controller promotion / demotion process, being sure not to indicate that this is the last domain controller in its domain (unless it really is and you're really sure you want to do that).

After the machine completes the process and restarts it will be a non-domain controller member server in the domain it was previously acting a as a domain controller within.

share|improve this answer

Use the server roles wizard. It should demote it nicely.

share|improve this answer

I like to run DCDIAG before demoting a DC. If your domain passes all those tests, there shouldn't be any issues running DCPROMO.

share|improve this answer

Make sure that the edition of 2003 is not SBS. If one of the Small Business Server editions finds it is not running as a domain controller it will shut itself down 60 minutes after startup. See for a little more detail.

share|improve this answer

DCPROMO is indeed the command you would use here. DCDIAG is useful as mentioned above. You might also want to use NTDSUTIL or the user interface equivalents to make sure you are aware of what FSMO roles this DC holds and then shift those roles to appropriate servers within your network. I'd make sure you get the Domain Naming Master and the infrastructure master off of this box and replicate it to everything else before moving forward.

share|improve this answer

Possible cleanup items; DNS and WINS. Check that the demoted DC pulled all its records (except A and PTR) from DNS; usually not a problem with MS-DNS, however, if it itself is its own DNS server (AD-integrated DNS), you may want to point it to another DNS during the process.

WINS (if you use it) - clean out the 1C record. Only way I know of is to delete it from all WINS servers, then re-register it on existing DC's.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.