In this guide we’ll cover off the process to demote a domain controller that is being replaced and the replacement DC has already been made the authoritive global catalog server while also holding the roles of FSMO, PDC, RID, etc.
When demoting a domain controller a reboot WILL be required for the process to complete.
The old DC will remain as a member server joined to AD, so any shares & services still hosted on it will continue to remain functional & accessible to the AD environment.
This guide assumes that all the relevant steps required have been followed & completed in here, here, and here.
Test Demote DC:
On the DC being demoted, launch an elevated PowerShell session
We’ll do a test to see what dependancies might be configured that would prevent a succssful demotion
Test-ADDSDomainControllerUninstallation -DemoteOperationMasterRole -RemoveApplicationpartitions
Explanation of Command:
Test-ADDSDomainControllerUninstallation: This command is to run the uninstallation test. It is like a simulation to check any issues or dependencies while uninstalling.
DemoteOperationMasterRole: This command is to demote all the Operations master roles i.e. FSMO (Flexible Single Master Operations role). We’ll talk in detail about FSMO roles in future articles.
LastDomainControllerInDomain: This switch is compulsary if this is the last DC in domain. If you have multiple DCs then do not use this.
RemoveApplicationPartitions: This switch is required to remove application partitions.
The first prompt will request you to enter in a new password to set for the built-in Administrator account.
This will output either a success or error result:
If you have a success result, you can proceed with domain controller demotion.
If you’ve received an error, you’ll need to address any and all errors before you can demote the domain controller.
Note: the above example mentions Certificate Server is installed. Although certificate services can be installed on non-DC member servers (and is generally best practice to not install it on a DC), if it IS installed on a DC, it MUST be migrated away from the DC before you can demote.
Other services can also inhibit demotion such as the presence of BitLocker tools, AD Federation Services, ADLDS, AD Rights Management Services, etc. – these would all need to be migrated & removed first.
Updates to Network Interfaces:
All domain controllers now need to have their primary DNS server IP configured to point to the current PDC.
Every other DC then needs to be listed as an additional DNS server
Finally, at the bottom of the DNS IP list should have the localhost IP of: 127.0.0.1
DC Demotion:
In our example, we will remove Domain Controller DC01-2019.
Open Server Manager
Click on Manage and select Remove Roles and Features
Select Next
Select the server from the pool and click Next
Clear the checkbox Active Directory Domain Services
Click Remove Features
Click on Demote this domain controller
Supply the admin credentials if needed and click Next
Note: Do NOT select the option Force the removal of this domain controller and leave it unchecked.
Check Proceed with removal and click Next
Enter a new administrator password for the local administrator account after the Domain Controller is demoted
Click on Demote
The server will go through the demotion process
Once the demote is done, the Windows Server will restart automatically
Step 4. Remove Active Directory Domain Services role
After the restart, you need to remove the ADDS role with the steps below:
Open Server Manager
Click on Manage and select Remove Roles and Features
Select the server from the pool and click Next
Clear the checkbox Active Directory Domain Services
Click Remove Features
Click Next
Click Next
Check the checkbox Restart the destination server automatically if required.
The removal is in progress
The Windows Server will restart and proceed further with the removal and finishes. Click Close.
The server will reboot and be a member server – like a standard server joined to AD – no longer a domain controller.
Now we need to clean up AD
Post DC Demotion AD Clean Up:
Removal of old DC from Sites and Services:
On a domain controller, launch AD Sites and Services
Expand Sites > Default-Fist-Site-Name > Servers
Right-click the old DC server and select Delete from the context menu
DNS Cleanup:
After you demote a domain controller, often there are pieces of information left over in DNS that still references it either as a zone server and or an MSDCS – even if you have configured DNS Aging and Scavenging in AD as this will only clean up dynamic DNS records, where DCs are usually static DNS records.
There are two options.
Option 1: Use the DNS Server Manager to manually clean up entries. While this takes longer, it allows you to manually check every record before deleting, ensuring the NEW DC is referenced in place as a zone master and msdcs pdc – also useful if the old DC is still serving network tasks such as a file server, print server, DHCP server, etc and you’re not yet ready to completely kill it.
Option 2: Use a PowerShell script to very quickly go through DNS and remove any references to of the old DC from all zones. This is quicker, but relies on the DNS to already be pretty healthy before we began, AND the old DC server has been completely removed & shutdown (no longer in use)
Option 1:
Launch DNS Manager
Expand absolutely every zone and remove any entry where the old DC is referenced as a name server (NS) record – also ensuring all other (relevant) DCs are listed as name servers
In the zone that begins with _mscds.domain.tld ensure that:
- the old DC is no longer referenced at all in any of the entries and subfolders
- in the pdc > _tcp folder the current PDC is noted
Option 2:
Use the below PowerShell script to remove the old DC from DNS:
$ServerFQDN = "dc01-2019.exoip.local." #Keep the dot (.) at the end
$ServerHostname = "dc01-2019"
$IPAddress = "192.168.1.51"
$Zones = Get-DnsServerZone | Where-Object { $_.ZoneType -eq "Primary" } |
Select-Object -ExpandProperty ZoneName
foreach ($Zone in $Zones) {
Get-DnsServerResourceRecord -ZoneName $Zone | Where-Object {
$_.RecordData.IPv4Address -eq $IPAddress -or
$_.RecordData.NameServer -eq $ServerFQDN -or
$_.RecordData.DomainName -eq $ServerFQDN -or
$_.RecordData.HostnameAlias -eq $ServerFQDN -or
$_.RecordData.MailExchange -eq $ServerFQDN -or
$_.HostName -eq $ServerHostname
} | Remove-DnsServerResourceRecord -ZoneName $Zone -Force -WhatIf
}
Conclusion:
You’ve successfully demoted a domain controllers and performed the steps required in AD to clean up post demotion.
Now you should consider raising the domain and forest functional levels.