How to Remove Data in the Active Directory After an Unsuccessful Domain Controller Demotion

• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Server

SUMMARY

This article describes how to remove data in the Active Directory after an unsuccessful domain controller demotion.

MORE INFORMATION

The DCPROMO (DCPROMO.EXE) utility is used for promoting a server to a domain controller and demoting a domain controller to a member server (or to a standalone server in a workgroup if the domain controller is the last in the domain). As part of the demotion process, the DCPROMO utility removes the configuration data for the domain controller from the Active Directory. This data takes the form of an "NTDS Settings" object, which exists as a child to the server object in the Active Directory Sites and Services Manager.

The information is in the following location in the Active Directory:

CN=NTDS Settings,CN=<servername>,CN=Servers,CN=<sitename>,CN=Sites,CN=Configuration,DC=<domain>...

The attributes of the NTDS Settings object include data representing how the domain controller is identified in respect to its replication partners, the naming contexts that are maintained on the machine, whether or not the domain controller is a Global Catalog server, and the default query policy. The NTDS Settings object is also a container that may have child objects that represent the domain controller's direct replication partners. This data is required for the domain controller to operate within the environment, but is retired upon demotion.

In the event the NTDS Settings object is not properly removed (for example, the NTDS Settings object is not properly removed from a demotion attempt), the administrator can use the NTDSUTIL.EXE utility to manually remove the NTDS Settings object. The following steps list the procedure for removing the NTDS Settings object in the Active Directory for a given domain controller. At each NTDSUTIL menu, the administrator can type help for more information about the available options.

CAUTION: The administrator should also check that replication has occurred since the demotion before manually removing the NTDS Settings object for any server. Using the NTDSUTIL utility improperly can result in partial or complete loss of Active Directory functionality.

1. Click Start, point to Programs, point to Accessories, and then click Command Prompt.



2. At the command prompt, type ntdsutil.



3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters need to be specified before the removal can occur.



4. Type connections and press ENTER. This menu is used to connect to the specific server on which the changes occur. If the currently logged on user does not have administrative permissions, alternate credentials can be supplied by specifying the credentials to use before making the connection. To do so, type set creds domain nameusernamepassword and press ENTER. For a null password, type null for the password parameter.



5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server.



6. Type quit and press ENTER. The Metadata Cleanup menu is displayed.



7. Type select operation target and press ENTER.



8. Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number.



9. Type select domain number and press ENTER, where number is the number associated with the domain to which the server you are removing is a member. The domain you select is used to determine if the server being removed is the last domain controller of that domain.



10. Type list sites and press ENTER. A list of sites, each with an associated number, is displayed.



11. Type select site number and press ENTER, where number is the number associated with the site to which the server you are removing is a member. You should receive a confirmation listing the site and domain you chose.



12. Type list servers in site and press ENTER. A list of servers in the site, each with an associated number, is displayed.



13. Type select server number, where number is the number associated with the server you want to remove. You receive a confirmation listing the selected server, its Domain Name Server (DNS) host name, and the location of the server's computer account you want to remove.



14. Type quit and press ENTER. The Metadata Cleanup menu is displayed.



15. Type remove selected server and press ENTER. You should receive confirmation that the removal completed successfully. If you receive the following error message

    Error 8419 (0x20E3)
    The DSA object could not be found

    the NTDS Settings object may already be removed from the Active Directory as the result of another administrator removing the NTDS Settings object, or replication of the successful removal of the object after running the DCPROMO utility.



16. Type quit at each menu to quit the NTDSUTIL utility. You should receive confirmation that the connection disconnected successfully.

Additional query words:

Keywords : kbenv
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbhowto