6

A month ago I migrated to SBS 2011 from 2003. When I decommissioned the old 2003 DC, I had it leave the domain. However, it still has a computer account in the AD. When I try to delete it I get this message (translated):

The object SRV2003 contains other objects. Do you want to remove the object SRV2003 and all the objects it contains?

If you cancel the removal in process any objects removed are not restored.

WARNING: If you check the box "Use server control for removal of subtrees" all objects in the subtree are removed, including objects which are protected against removal, and the removal cannot be undone.

How can I list these objects? I'd hope they are safe to remove, but I'd like to be sure...

Improve this question

3 Answers 3

Reset to default
8

If you click "View..." in the ADUC MMC and select "Users, Groups, and Computers as Containers..." you will be able to view the sub-objects. If you are running ADUC on an OS newer than 03' I believe that selection is re-named "View objects as Containers...".

Improve this answer
2
  • Thank you! For the record, the contents of the subtree was a share that the server used to have.
    – carlpett
    May 8, 2011 at 10:45
  • I had a similar issue removing a particular user account, and this answer saved me. Now I have a new trick up my sleeve and a bit more knowledge about AD. Have an upvote.
    – Ben Wyatt
    Oct 19, 2011 at 18:39
3

When you say that you had it leave the domain do you mean that you ran DCPROMO on it? It doesn't sound like it. Did you just disconnect it from the network?

I might suggest that you run DCPROMO on the old DC and then delete it, if that's still possible.

If not, and if you've migrated everything (FSMO roles, DNS, DFS, etc.) to the new server then it's perfectly safe to delete the old server. The old DC holds NTFRS subscriptions and that's what the message is pertaining to. You probably have some other manual clean up to do (DNS, metadata) if you didn't properly demote (DCPROMO) the old DC.

Improve this answer
2
  • Hi! What I meant was that I assigned it to a workgroup instead of the domain. I did use DCPromo to demote it.
    – carlpett
    May 8, 2011 at 10:43
  • 1
    If you ran DCPROMO and removed it from the domain then it's perfectly safe to delete the computer object.
    – joeqwerty
    May 8, 2011 at 12:42
3

If you want to see all of the objects, you can use Active Directory Explorer. Right-click on the domain, select Search Container, and for Attribute DistinguishedName, select EndsWith, and insert the distinguished name (DN) of your DC, and click Add, then Search.

If you don't know the DN, it is probably something like the following, where DC1 is the DC name, although you may not have DC=domainName, depending on your namespace.

CN=DC1,OU=Domain Controllers,DC=domainName,DC=company,DC=com

At a minimum, the objects are typically: 

CN=NTFRS Subscriptions,CN=DC1,OU=Domain Controllers,DC=domainName,DC=company,DC=com  
CN=Domain System Volume (SYSVOL share),CN=NTFRS Subscriptions,CN=DC1,OU=Domain Controllers,DC=domainName,DC=company,DC=com  
CN=RID Set,CN=DC1,OU=Domain Controllers,DC=domainName,DC=company,DC=com

There may also be settings in the Site Configuration container:

CN=DC1,CN=Servers,CN=,CN=Sites,CN=Configuration,DC=domainName,DC=company,DC=com

So you would want to perform a search for a distinguished name ending with that, or browse that location. There will typically be several settings objects located there, such as NTDS Settings and one or more child connection objects. Even though these objects are not in the same location as the server, they typically have a backlink in the form of the serverReference attribute.

Active Directory Explorer:

http://technet.microsoft.com/en-us/sysinternals/bb963907

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .