2

We currently have two DC's for our one domain but as of now do not have anyone actually authenticating to them so I'd like to take the chance to install it correctly. The domain was setup before I was hired and was done sloppily and is also using the correct naming structure as per this MdMarra post. http://www.mdmarra.com/2013/04/best-practices-for-configuring-new.html

I've decommissioned DC's in the past, seized/transfered roles, etc; but have never tried to completely remove a domain from the network. Will the "/forceremoval" switch + removing metadata be enough?

I'd really like to avoid re-installing Windows.

Other Info: Both on Server 2008 R2. Both have DNS installed. DC1 resides in 192.168.1.x/24 AND 192.168.2.x/24 and runs DHCP for both subnets. DC2 is on 192.168.2.x/24.

  • 4
    Well, regardless of your personal preferences, reinstalling Windows is probably the safest and least time-consuming approach. Why not start off with a clean slate? – Mathias R. Jessen May 31 '13 at 16:15
  • 1
    Statements like this "The domain was setup before I was hired and was done sloppily" always leads me to believe that the person making the statement doesn't have as good a grasp on AD as they think they do. Sloppy is not a technical description of AD related problems. Sloppy is a way of saying "I really don't know what I'm looking at or dealing with but it doesn't look right to me. Since I don't have the required experience or understanding to describe the actual problem I'll just call it sloppy". - What do you mean that it was done "sloppily"? – joeqwerty May 31 '13 at 16:21
  • 1
    @joeqwerty Lol typical SF "friendliness" :D. Not sure how this adds to the discussion but: No reverse lookup zones/ptr's, no AD recycle bin enabled, DNS on the "PDC" (server with the majority of the roles) not pointing to itself, bad naming convention, no replication, IPv6 still enabled, ZERO updates, and about a million errors in the EV. And those are JUST the things I noticed in an hour. There could be other dangerous missteps I'm not seeing. – Copy Run Start May 31 '13 at 16:33
  • 3
    "DNS on the "PDC" (server with the majority of the roles) not pointing to itself" - actually, you don't want it to. A DC's primary DNS should be a different DNS server that is also authoritative for the AD zone(s) (which is usually another DC). It should only hit itself if no one else is available to serve the zone. – mfinni May 31 '13 at 16:54
  • 2
    Shout out for my blog! :) – MDMarra May 31 '13 at 17:18
6

AD DS is a server role that can be removed just like any other server role. Run DCPROMO on both DC's to demote them. When you demote the last DC make sure to select the option that it is the last DC in the domain. This will revert both DC's to standalone servers.

You're probably going to need to revisit and probably reconfigure DHCP and DNS in order to continue to serve your network clients.

EDIT:

Here's my opinion on some of the issues you related in your comment:

rDNS zone missing: an rDNS zone isn't a requirement for AD. It's a preference. There isn't any function of AD that needs or requires an rDNS zone. I personally prefer to create an rDNS zone.

AD Recycle Bin not enabled: Again, this is a preference and not a requirement. I prefer to enable it.

IPv6 enabled: This is debatable. I'm not convinced that it should be disabled. I know that there's a lot of information on the internet for and against but I've never had an issue leaving it enabled and I haven't seen any technical information from MS that recommends disabling it.

No Replication: If the DC's aren't replicating than that's definitely a problem that would need to be resolved if you were leaving the domain intact.

  • Thank you. I think I was vague in my question. I'm aware of those steps. Essentially what I'm asking is: are there any caveats or special steps that I should be aware of and is it considered "bad practice" to not just re-install Windows. – Copy Run Start May 31 '13 at 16:40
  • 1
    I can't think of anything other than making sure you have a working DHCP and DNS when you're done. I don't think it's bad practice to remove the AD DS role and leave the servers intact rather than reinstalling Windows. – joeqwerty May 31 '13 at 16:43
  • 1
    Make sure you know the local administrative password before you do anything, just a word of advice that sometimes gets overlooked. – user160910 May 31 '13 at 17:51
  • 1
    @GreggLeventhal - The process of demoting a DC will prompt for a new password for the local Administrator account since a DC technically doesn't have one and the server won't have one until the demotion completes.. – joeqwerty May 31 '13 at 21:06
  • 2
    @CopyRunStart Like Joe says, IPv6 should not be disabled on any Windows systems. Even if you don't run IPv6 and let the v6 interfaces autoconfigure with link-local addresses, that's the preferred and recommended config. Microsoft explicitly states that they do all testing with IPv6 enabled and that disabling it puts you into a configuration that they have not done QA testing for. – MDMarra May 31 '13 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.