Yesterday I demoted a 2003R2 DC (but forgot to remove the DNS role), removed it from the domain, changed it's IP address and shut it down. Everything went pretty well (minus a host of authentication issues across the domain until I added the old IP for this DC to it's replacement 2008R2 DC) but I'm still seeing four SRV records in DNS for this DC. DNS is still showing _ldap SRV records for DC1, one each under:

DC1 is not listed under any other zone including _msdcs.

Can I simply delete these _ldap SRV records for the demoted DC?


This might be indicative of a replication problem in your environment. You should use repadmin and dcdiag to make sure that there aren't replication problems. If there aren't you might consider using ntdsutil to do a metadata cleanup since it sounds like the demotion might not have happened cleanly despite the wizard's completion.

In all likelihood, you are safe to just delete the offending SRV records, but they may be the tip of the iceberg for a larger problem. Better safe than sorry.

  • So running dcdiag on each remaining DC doesn't bring up any issues except for NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS not having Replicating Directory Changes in the ForestDnsZones and DomainDnsZones on the 2008R2 DCs. According to MS KB967482 this is expected as I don't have / plan to have a RODC and thus didn't run /rodcprep. Using repadmin with /showrepl, /replsummary and /showutdvec doesn't show anything bad (but a GUID last updated in April 2006?). I'm hesitant to run metadata cleanup as ADSS doesn't show DC1 at all (TechNet Library cc816907). So, I'll just delete them later today. – Christopher Williams Jul 18 '12 at 19:58
  • Yeah, sounds like it's just old records for some reason. Sort of odd that they're still there, but if there aren't any problems, then no reason to worry. – MDMarra Jul 18 '12 at 20:01

Remove them!

Let's say a client needs to locate an ldap endpoint in the Default-First-Site-Name site.

NetLogon queries its DNS server for


to acquire information about such a service. DC1 is returned, and the client tries to resolve DC1, and has to wait for the query to either timeout or return false.

Now it can start the process over, and the old records thus resulted in degraded performance ;-)


If you're not using that server for DNS and your hosts don't have to make service requests you can delete the records, or simply uninstall DNS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.