When attempting to demote a Windows 2012 Domain controller I encounter the following warning:
No other domain controller could be contacted, but other domain controller objects are in the directory. If you are certain that this is that last domain controller for the domain and want to proceed, confirm that this is that domain controller in the domain.
However, this is not the last domain controller for the domain.
If I check
Force the removal of this domain controller I am warned:
Unless this is the last domain controller in the domain, you must perform metadata cleanup manually after removal.
How do I safely demote this domain controller? Why does it claim it can't contact the other domain controller? How safe is forced removal with "manual" metadata cleanup?
Chasing down messages from
dcdiag, I have found that the other DC that currently holds the PDCe role does not have any SYSVOL shares, and it's
\Windows\SYSVOL\sysvol\domain.example.com is empty. I believe that is what's causing the problem, but I'm not sure how to proceed.
DomainMode : Windows2012Domain
ForestMode : Windows2003Forest
This domain controller was the first domain controller for the domain and as such held the InfrastructureMaster, PDCEmulator and RIDMaster roles. However, these roles were transferred using
Move-ADDirectoryServerOperationMasterRole to the other domain controller without apparent incident prior to any attempt at demotion.
The domain controller is a Global Catalog and an AD DNS server, as is the other domain controller, which now holds the FSMO roles, as are the domain controllers for the forest.
The same warnings are not triggered on the other domain controller.
repadmin /replsummary shows no apparent problems.
There has been no customization of the Windows Firewall. The domain controllers are on the same VLAN and no interface specific ACLs are applied along their path.