Server Demotion Woes ..

[soveryapt]

Afternoon Folks

 

So, I've been having some issues with logons of late and have noticed that our secondary (and older) server seems to be having issues (it's got a couple of drives and / or it's RAID controller flashing at me like a mad'un for a start) so I've decided to demote it from being a DC as it's not needed as one really.

 

So, I've gone through the various processes and what not (migrated the CA Services, ensuring the various roles are on the newer DC, rebooted the one I'm looking to demote, etc) and got the stage of running dcpromo, which I'm doing from an elevated command prompt, but I keep getting the following error:

 

The operation failed because:

 

The wizard could not authenticate to Active Directory Domain Controller xxx using the supplied credentials.

 

"The specified server cannot perform the requested operation."

 

Initially I was running dcpromo from a standard command prompt, so I opened an elevated one, and I'm logged on using the administrators account for the domain.

 

HELLP!

 

Thanks

Andy

[jamesreedersmith]

Check primary DNS is configured to point at an alternate DC when demoting - not doing this can cause this problem.

[Michael]

Are the servers definitely replicating OK and is DNS in order? These are the sort of problems that can prevent dcpromo running correctly.

[soveryapt]

Check primary DNS is configured to point at an alternate DC when demoting - not doing this can cause this problem.

 

Yup, the DNS points to the newer G6 server's IP Address ..

[soveryapt]

Are the servers definitely replicating OK and is DNS in order? These are the sort of problems that can prevent dcpromo running correctly.

 

I think there might be a replication issue going on, hence looking to remove that as staff are coming when they've changed their password and finding that it's not actually changed .. hence looking at all this in the first place ..

[Chuckster]

Seeing as you can't demote right now, perhaps it's worth running a test on your DNS.

 

From command prompt run this command: dcdiag /test:dns

 

Just to see if there are any errors and what have you.

[soveryapt]

Ok, so just run a repadmin /showrepl and it's saying server down, so tried connecting to the server using \\servername and it's saying it can't connect .. oh dear .. some digging to be done me thinks ..

[soveryapt]

Seeing as you can't demote right now, perhaps it's worth running a test on your DNS.

 

From command prompt run this command: dcdiag /test:dns

 

Just to see if there are any errors and what have you.

 

All passed .. just running a few other dcdiag tests to see what it brings up ..

[soveryapt]

Right, run a dcdiag /ReplSource test and it's failing on:

 

KCCEvent

KnowsOfRoleHolders

Replications

SystemLog

 

Everything else is fine, so looks like something somewhere is block replications (which I think is therefore causing the other fails) .. let the digging commence .. whoop ..

[Michael]

If you're confident DNS isn't the issue, you'll need to initialise burflags. This'll make the other working DC authoritative and restore replication. Once this is done, you can then safely run dcpromo and properly demote it.

[3s-gtech]

Check the DFS-R event logs. Had lots of fun recently with Jet database errors causing DFS-R replication between DCs to fail, leaving the sysvol inconsistent (how this affects the AD DB I'm not so sure). The Event Viewer actually tells you the command to run which fixes the issue. This can happen if you have a dirty shutdown on a DC. You can set a registry entry which stops it recurring though:

 

 

 

Key: HKey_Local_Machine\System\CurrentControlSet\Services\DFSR\Parameters

 

Value [DWORD]: StopReplicationOnAutoRecovery

 

Data: 0

 

This is relevant in pre-2012 R2 OSs too DFS Replication in Windows Server 2012 R2: Revenge of the Sync - The Storage Team at Microsoft - File Cabinet Blog - Site Home - TechNet Blogs

[bart21]

If server is no longer required, turn it off and run a metadata cleanup on the good dc.

 

Nick

[soveryapt]

Thanks for all your help guys. In the end I've gone through, checked for any updates and such and installed those on both servers, and following a quick reboot of them both (well as quick as servers reboot! lol) I've just managed to successfully demote the older server. Hopefully this will help fix a few other issues I've been having at the school now it's just a member server instead.

 

Now to plan other updates and such (PaperCut etc). All the fun of the fair for me!