Alright, so I think at some point, every SysAdmin will have a domain controller fail. Every SysAdmin should also know that unless you run dcpromo.exe to demote a domain controller before removing it from AD, you can have some issues. From FSMO to DFRS, it’s just not a good situation. Here is a summary guide on how to clean up AD after one of your Domain Controllers fail. Also, this looks long, but it’s all very simple, just putting it into step-by-step sort of drags it out, so no worries, this should be about a 30 minute process.
USE CAUTION: Improperly using ntdsutil may result in partial or complete loss of Active Directory functionality… Don’t go exploring without doing your research.
STEP 1:
Finding Current FSMO Role Masters
First, We need to know whether that particular server was holding any of the FSMO roles. To check this, we have a couple options, Either via the GUI(1), or via ntdsutil(2). Personally, I prefer to do it via ntdsutil, as I always feel that there is more power in the command line. Also, I just hate using a mouse. There are other options, but these two are all that I will cover in this post. For more you can look into “netdom” or “replmon” tools from microsoft, these are not included in windows by default, so I will overlook them for now. (NOTE: For this, I definitely recommend ntdsutil, as in step 2, I will expect it to already be open and connected. the GUI Method, is more for information.)
Method 1:
Open AD Users and Computers.
Right-click the name of the domain you are wanting to look at, then select Operations Masters.
From this view, you can determine the current Domain-Specific RID Master, PDC Emulator, and Infrastructure Master FSMO Roles.
Now, open AD Domains and Trusts,
Right-click the AD Domains and Trusts in the nav. pane and go to Operations Masters. This will show you the Domain Naming Master Role.
Finally, to find the Schema Master, you will have an extra step. You will need to register the Schmmgmt.dll library first.
Goto: Start>Run and type:
regsvr32 schmmgmt.dll
Hit Enter, you should see a success message.
Now, that should allow you to open a new console: AD Schema. To open it, goto: Start>Run, type:
mmc
hit enter. Now, in the management console, goto File>Add/Remove Snap-in> click Add. Double Click Active Directory Schema and close the add/remove dialog windows.
Now, right-click the AD Schema icon and goto Operations Masters.
Method 2:
To check the FSMO Roles via the command line using ntdsutil, we will need to do the following.
Alright, let’s open up a command prompt, then type
ntdsutil
and hit enter.
at the ntdsutil prompt, you will type
roles
hit enter.
Now, you should see a screen that says “fsmo maintenance”. type
connections
and hit enter again. Here you will connect to the server you want to become the FSMO master(localhost works, if thats what you want). So type:
connect to server <FQDN of server>
and hit enter again. now you will leave the server connections page and go back to fsmo maintenance. Type:
q
Now we should be back in fsmo maintenance, type
select operation target
Hit Enter. Then type:
list roles
Once you hit enter, it should show you the servers that hold each role.
Type “q” to get back to fsmo maintenance, but stay at this screen for the next step.
STEP 2:
Seizing FSMO Roles From Dead Server
OK, so this step is optional. based on the results of your last step. You only need to seize the roles if the FSMO master is no longer operational. To do this step we will use ntdsutil.
Now, we need to seize the roles that are on our dead server. You should know what roles your dead server holds from the last step, so only do this command for those. Remember, I had you connect to the server that will receive the FSMO role(s). A quick way to see the syntax for seizing is just type “?” and it will show you how to transfer/seize, it is basically:
seize <role>
as in:
seize schema master
or for transfers(only to be done if current master is still live/active)
transfer <role>
To verify the roles transferred(ignore the errors you get at first, you are guaranteed to have one since the current master is unavailable), put in
select operation target
then the same way we found the masters before:
list roles for connected server
Now, we’re almost done, we have transferred the FSMO roles(the biggest potential problem), and just need to cleanup the AD metadata and sites/services.
STEP 3:
Metadata Cleanup
For the next step, we will go back to the first ntdsutil prompt. type “q” and hit enter until your prompt says “ntdsutil:”. Type
metadata cleanup
hit enter. You should still be connected to a domain controller, but if you closed ntdsutil and reopened it, you will need to put in
connections
then
connect to server <servername>
then type quit back to the metadata cleanup prompt (”q”). Now, we will pick our target for cleanup. Type:
select operation target
At this point, if you only have 1 domain, or within the domain you pick, only 1 site, you can skip some steps. Your domain number, site number will be “0″(zero) if there is only one. For the sake of thoroughness, I will show you how to find the index anyway. To find the domain, type:
list domains
Now, find the domain you want to work with, and type:
select domain <number>
Now, we find the site within the domain where the domain controller used to reside.
list sites
put in the site you want:
select site <number>
To find the servers within that site, type:
list servers in site
then we will select the inactive server by typing:
select server <number>
Now, type enter “q” to quit back to metadata cleanup prompt. The final command to cleanup all metadata for that server is:
remove selected
You will receive a warning, but if you’re positive that server is down and will need rebuilt, you should be safe to hit Yes. You should get a message saying it was removed successfully. If you receive an error that the object could not be found, it was probably already removed from the domain controller. Open up AD Users and Computers to verify the server is gone from the Domain Controllers OU. Alright, we’re almost done, just another 5 minutes of work, at the most.
Step 4:
Remove The Server From Sites & Services
This will be done via the AD Sites & Services Snap-in. Just expand the site where the server was located, and delete the object for the failed server… This step is done.
Step 5:
Remove The Server From DNS
This step depends a lot on how you have your DNS set up, I am assuming the DNS is run on a Windows server, and hopefully a DC. It doesn’t have to be, that’s just how i prefer it. Unfortunately, where I work, The DNS servers are separate and I have no access to them… such a pain. Anyway, open up your DNS Management Console. I hope you know this, but it’s:
Start>run> type “mmc”, hit enter. Goto File>Add/Remove Snap-in>hit Add>double-click DNS>Close>Close.
Now, expand the zone where the server used to be(probably Forward Lookup Zones>domain.local), and delete the A record(also called a host record) for the server. Remove the CNAME record in the _msdcs.root domain of forest zone in DNS. If you have reverse lookup zones, also remove the server from these zones. If you have anywhere else the server is referenced, or are unsure, you might want to check for these now.
You’re Done! Now, you should be good to go. Let me know if any of you have issues with this guide, notice anything wrong, or just have errors/questions. I will be glad to help, and I know I have some pretty atrocious grammar/spelling at times.
