2

I have a Windows Server 2003 machine that is our domain controller. It is the only domain controller (I know bad practice). It is having some hardware issues so I want to move the domain controller to a Windows Server 2012 machine. I ran the following dcdiag command just to make sure the domain was healthy before migrating the DC:

Dcdiag /v /c /d /e /s:SERVER001 >c:\dcdiag.log

Looking through the log, all the tests passed except for the VerifyEnterpriseReferences test. I am receiving the following:

  Starting test: VerifyEnterpriseReferences
     The following problems were found while verifying various important DN
     references.  Note, that  these problems can be reported because of
     latency in replication.  So follow up to resolve the following
     problems, only if the same problem is reported on all DCs for a given
     domain or if  the problem persists after replication has had
     reasonable time to replicate changes. 
        [1] Problem: Missing Expected Value
         Base Object:
        CN=AMPNT1,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=Ampdomain,DC=com
         Base Object Description: "SYSVOL FRS Member Object"
         Value Object Attribute Name: frsComputerReference
         Value Object Description: "DC Account Object"
         Recommended Action: Check if this server is deleted, and if so
        clean up this DCs SYSVOL FRS Member Object.  Also see Knowledge
        Base Article:  Q312862

        [2] Problem: Missing Expected Value
         Base Object:
        CN=AMPNT1,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=Ampdomain,DC=com
         Base Object Description: "SYSVOL FRS Member Object"
         Value Object Attribute Name: serverReference
         Value Object Description: "DSA Object"
         Recommended Action: Check if this server is deleted, and if so
        clean up this DCs SYSVOL FRS Member Object.  Also see Knowledge
        Base Article  Q312862

     ......................... SERVER001 failed test VerifyEnterpriseReferences

AMPNT1 just happens to be an old Windows 2000 Server machine. A while back I had the DC functionality moved from it to the SERVER001 machine. I am guessing it did not get demoted properly.

Looking at the Q312862 article referenced above in the log file I noticed it is for recovering missing objects. I am thinking I don't need to recover the objects, but rather completely remove them. So with a little searching I found How to remove completely orphaned Domain Controller.

I was working through the steps and I am getting stuck on step 13. I am not seeing an entry for server AMPNT1. Here is what I am getting:

enter image description here

What might I be doing wrong? How do I go about fixing the VerifyEnterpriseReferences failed test? Am I moving in the right direction? Does this need to be corrected before moving the DC functionality to the Windows Server 2012 machine?

You can see in the following screenshots AMPNT1 is not found in The Domain Controllers object of Active Directory Users and Computers nor under the Servers node of Active Directory Sites and Services:

enter image description here

enter image description here

  • Your screenshot doesn't show step 12 "list servers in site"...so I'm guessing you did that and it only listed the valid server and not AMPNT1? – TheCleaner Oct 16 '14 at 14:32
  • @TheCleaner, I corrected the command prompt image. – Linger Oct 16 '14 at 14:44
3

A better article for what you're trying to do is: How to remove data in Active Directory after an unsuccessful domain controller demotion.

Based on your screenshot of the ntfsutil command you just need to continue with the procedure. Your next step is a select site 0, followed by a list servers in site and a select server x (where x is the ordinal returned for the server you want to remove). Then you'll quit and remove selected server.

Edit:

Pardon me for doing a poor job reading.

It looks like the old AMPNT1 server has been removed from the Active Directory Sites and Services, so you're all done with ntdsutil.

To get rid of the "VerifyEnterpriseReferences" failure in the dcdiag output, use adisedit (from the Windows Support Tools) to navigate to the "Domain System Volume (SYSVOL share)" subcontainer in the "File Replication Service" container under the "System" container of the "Domain" partition of the directory. You'll find an "AMPNT1" object there. Delete that object to remove the reference that's appearing in the "VerifyEnterpriseReferences" output.

It's don't believe it's strictly necessary to clean this up before deploying a Windows Server 2012 DC, but I certainly would.

  • that is actually the KB article I was using. It is under step 1 of the resolution section of How to remove completely orphaned Domain Controller linked in my question. I updated my question. I didn't show the full results of the command prompt. As you can see, when I execute list servers in site it is not showing AMPNT1. – Linger Oct 16 '14 at 14:56
  • using adisedit worked like a charm. I reran Dcdiag and did not receive any failed test. Thanks for your help. – Linger Oct 16 '14 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.