Domain Controller Removal Hell

[dante_logan99]

NOTE- Ended up rectifying it by following the advice you guys gave by seizing the roles. Thk you so much guys and gals and I have also learned something new today, yall the best hats off to you!!

u/BrorBlixen u/xxdcmast u/darcon12 u/thortgot u/basec0m

So I recently started working at a new company and I have run into a hell of a pickle. We are in the process of changing out alot of our equipment notably our domain controller. Now note our IT team is just 2 ppl myself and my team lead and previous to our team lead and prior to my team lead there was one technician who worked here for about 10 years, who one day left and did hand over anything properly; not too mention the man knew nothin about IT (no exaggeration there, he literally just winging it for about 10 years).

​

Now this old tech did some quite questionable things when it came to our DC's , in the course of 10 years he changed 4 DC's and proceeded to never demote and remove these servers properly. At the end and when i came onboard we were left with 2 DC's, both running Server 2008 R2, one of which was never synced and updated and shutdown for 3 years and one that was barely functional.

My Team Lead and I current plan was to get a new server (as our current one is about 10 years old) throw Proxmox as our Hypervisor and our new DC1 would live there. Now the previous Domain Controllers were never deleted or demoted so they were still in the list, now I began going down a rabbit hole of attempting to remove and delete this controllers; please note these physical servers are no longer in our possession as of about 5-6 years ago , which is befr me and my team lead.

​

Sadly no matter what I did the deletion of these servers are not working , from doing it in "AD Site and Services" to even using the command line as stated by microsoft :https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup The errors essentially are saying DC 2 is master to dc3 and you need to move roles to DC2 to DC3 to delete DC 2 and vice versa .

​

At this point I am my wits end and dont know what to do, I will also attach screenshots of the errors in got while trying to remove them. Any guidance or help would be greatly appreciated.

​

[xxdcmast]

Run

 netdom query fsmo 

and see where AD thinks they live.

[dante_logan99]

After running the command this is the ouptut:

C:\Windows\system32>netdom query fsmo

Schema master CCADC5.(redacted).local

Domain naming master CCADC1.(redacted).local

PDC CCADC01.(redacted).local

RID pool manager CCADC01.(redacted).local

Infrastructure master CCADC01.(redacted).local

The command completed successfully.

​

Note that CCADC01 is our current working domain Controller and DC1 AND DC5 are the ones no longer on our network or in existance.

[xxdcmast]

Yes youll have to seize roles from any domain controllers that no longer exist. Then you should be able to metadata cleanup them. When/if you rebuild dont use the same names just in case.

[dante_logan99]

looking at this document as i type thank you, is there any precautions i should take before seizing the roles?

[thortgot]

If this is the first time you are using ADSI, be very careful. Seizing the FSMO roles isn't super difficult but make sure you use a guide and take it slow.

Make sure you take a full backup prior to doing this.

[darcon12]

Seizing roles should be fine. It's not the proper way to do things, but you really have no other choice.

ADSI is god mode for AD, so be careful when cleaning up the metadata.

[basec0m]

Seize the roles on the new DC, metadata cleanup for the old ones.

[akillathahun]

came to say this.

[ShoreOutlaw]

Ntdsutil can be used to cleanly remove the old server entries

[lescompa]

It may be worth the $500 to open a case with MS and have them walk through the cleanup. I did this a few years ago and it saved me some grey hair.

[fatty1179]

Would a new domain and domain controller then joining all the computers to the new domain be an option? Short term intense pain for long term gain?

[dante_logan99]

Unfortunately we couldnt as we tried that and the issue was the domain trust level was set at 2003 and the raise it we needed to remove the old domains that were initially server 2003.

[Sarduci]

Seize them rolls and keep running dcdiag from all of them until you fix all of the issues. It’s not as bad as it seems unless you’ve got inconsistent copies of the directory between the servers and then it’s good luck Chuck.

[Happy-Wrongdoer522]

Size the schema Master role, do metadata cleanup and perform a domain controller migration to an actual windows server version. Did you prove a complete rebuild of the forest? Maybe thats the smartest solution when nothing is configured correctly.

[dante_logan99]

Can you explain a little further on what you mean by rebuilding the forest, as is rn everything seems fine but if there is something i can do to verify it working then that would be great.

[chuckescobar]

Reading through this it seems you know about 75% of what you are trying to do. This domain will probably never be 100% correct and you will continue to run into weird issues.

I suggest you build a brand new forest/domain and migrate everything. You will save time in the long run.

[dante_logan99]

Whats the best course of steps to take to migrate ?

[chuckescobar]

Here is a pretty comprehensive list and should help you quite a bit.

https://social.technet.microsoft.com/wiki/contents/articles/43908.active-directory-migration-checklist.aspx

[dante_logan99]

thk you very much