I have inherited this mess and I am unsure to proceed.

  • 1# Server 2k3 Domain controller
  • 2# Server 2k8 secondary DC

Problem 1

The previous SYS apparently half migrated the system, and the 1# is no longer with us. #2 is now stuck as a secondary Domain Controller, none of the computers can be gpupdated etc.

How do I force it to be the domain controller without the first server?


Server is stuck at 2k3 Domain fuctional level. It is 2k8 again how can I raise the fuction level to 2k8?

What are my options?

I haven't seen a post with options for migration fix without the originating server.

  • 2
    If the 2003 domain controller no longer exists, it needs to be deleted from the directory. – Greg Askew Sep 28 '16 at 17:52
  • Please only one problem per question the next time, or at least questions that are related. – Daniel Sep 29 '16 at 9:50
  • I apologize Daniel, I thought that they were tied by the same issue. – AICHNYC Sep 30 '16 at 19:49

The question is a bit unclear, but I'm guessing your Active Directory expects two domain controllers to be there, while one of them isn't available anymore; thus you need to clean things up.

First of all, make sure the 2K3 DC will never be reconnected to the network again: AD cleanup is a highly disruptive process, and all hell will break loose if the DC you are removing ever tries again to contact the domain.

Before beginning, have the remaining DC use its own IP address as its DNS server (in the NIC properties), and only itself. This of course assumes DNS is installed and active on the machine (which is standard practice for domain controllers); if this is not the case, you are in Big Troubles, because DNS is critical to proper AD operation: stop now and post this issue as a comment and/or a new question, and we'll add instructions to make DNS work; you absolutely need a working DNS for your AD domain in order to continue.

The first step is making sure all FSMO roles are held by the remaining DC; if one or more of them are still assigned to the dead DC, you'll need to seize them.

Afther this is done, you'll need to clean up AD metadata about the dead DC.

When your AD will finally be convinced that you only have one DC, then it will be a really good time to create a second one (you don't want to lose everything if your single DC fails, don't you?). You'll also be able to raise the domain and forest functional levels.

Oh, and BTW, there is no such thing as a "primary" or "backup" domain controller in Active Directory; apart from FSMO roles, all DCs are equals. Those terms ceased to make sense as soon as Windows 2000 replaced Windows NT.

| improve this answer | |
  1. Seize the FSMO roles to the new server.

  2. Clean up the old server using NTDSUTIL.

  3. Configure the new server to sync to an external time source.

  4. Reconfigure your domain clients to use the new server for primary DNS.

  5. Optionally, raise the Forest and Domain functional levels.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.