OK, last time we pointed out the fact that sometimes DCPROMO doesn’t work properly to demote a domain controller. The handy command that you can use in such cases (with care!) is “dcpromo /forceremoval.” By the way, before doing this, you should make sure you know the directory services restore mode password, or set it using NTDSUTIL. It’s also a good idea to try transferring any FSMO roles that the DC might be hosting, to another DC, before forcibly demoting it. And you’ll need some special syntax if the machine you are demoting is running Server Core (specifically the /demotefsmo and /administratorpassword qualifiers).
What the “/forceremoval” switch does is to tell DCPROMO not to worry about replicating any local changes out to another domain controller. (This means that any such changes to the directory will be lost.) This will also work if your DNS is not configured correctly, or if the DC can’t access DNS for some reason. Naturally, you’ll want to chase down the underlying cause of such issues if you can, before using the sledgehammer approach of /forceremoval.
There’s a fair amount of cleanup that you should do after forcibly demoting a domain controller: removing the relevant DNS records, making sure your FSMO roles are all present on other DC’s, setting up another DC as a global catalog server if the one you demoted was a GC, using NTDSUTIL to perform a metadata cleanup, removing the demoted DC from the Domain Controllers container, and so forth. It’s too much to cover here, but perhaps this will point you in the right direction!
Recent posts:
