edutech4schools Posted November 19, 2014 Posted November 19, 2014 I have just noticed my second DC which is a virtual server had become paused. Looking into the issue it's because the drive the vm was on get full. Anyway I have the space back and am aware that un-pausing would not be a good option in the same way that snapshots are a no no for a DC. It looks like the pause has been on for almost a Month so what I have done is powered off the VM. Do you think I will be OK to now turn this DC server VM back on? I had something similar happen once before and turning on worked fine but it was only paused for a few days. What are everyone's thought about powering on this VM.
3s-gtech Posted November 19, 2014 Posted November 19, 2014 I would pull the virtual NIC, the reboot it. Demote it if possible, then re-promote. It may just work without any faff at all - DCs are supposed to operate like that, for example if a remote site can't be contacted for a while - so I'd hope that it can tolerate this. Would pay to keep an eye on the logs if you do go for it.
tmcd35 Posted November 19, 2014 Posted November 19, 2014 I really, really wouldn't - personally. Is it only a DC or does it have other roles (other than DNS)? Does it hold any of your FSMO roles? My gut instinct would be to clean up your AD with it turned off. Make sure every mention of the server is removed from DNS, AD Users, AD Sites&Services, etc. Full meta data cleanup, the works. Then build a new DC in it's place. New name, new IP. But then I'm paranoid about these sorts of things.
edutech4schools Posted November 19, 2014 Author Posted November 19, 2014 s it only a DC or does it have other roles (other than DNS)? Does it hold any of your FSMO roles? It is only a dc with GC. The other DC has all the FSMO roles and is also a GC. Do you only have 2 DCs? Yes, the one that has paused is my 'backup dc' and is a vm.
3s-gtech Posted November 19, 2014 Posted November 19, 2014 Yeah, scrape it out of AD and remove it. Then rebuild and promote. A DC should always be regarded as expendable IME - that's why it's best to have as few roles on it as possible.
sister_annex Posted November 19, 2014 Posted November 19, 2014 I would build the new server first make sure that AD is replicating properly and then sort out the old one - last thing you're going to want is a completely failed AD structure...
edutech4schools Posted November 20, 2014 Author Posted November 20, 2014 Thanks for all the ideas. I have managed to find just about enough space on the server to create a new VM while leaving the old one switched off. Any advice about removing the old DC from my main DC. Is it just a case of going into AD, DHCP etc and deleting any references to the old DC or is their a specific method.
edutech4schools Posted November 24, 2014 Author Posted November 24, 2014 Any advice about removing the old DC from my main DC. Is it just a case of going into AD, DHCP etc and deleting any references to the old DC or is their a specific method. I am wanting to clean DNS as I have found some really old servers listed.
3s-gtech Posted November 24, 2014 Posted November 24, 2014 In newer versions of Windows Server, just deleting the object from AD is enough to clean out the references to those old objects. However, I have found some things get stuck - like DCs. In which case, it's worth having a browse through the directory with ADSIEdit to check. DNS should be manually cleaned too, carefully.
edutech4schools Posted November 25, 2014 Author Posted November 25, 2014 Found a really old server listed in AD that has been disabled but get the following question when trying to delete. object contains other objects. are you sure you want to delete *** object and all the objects it contains It then goes on about subtree deletion and gives me a tick box with the option to delete the subtree server control. Am I OK to delete the subtree?
3s-gtech Posted November 25, 2014 Posted November 25, 2014 Yes. The server object is actually a container - deleting it will delete the sub entries which you also won't want.
edutech4schools Posted November 25, 2014 Author Posted November 25, 2014 OK done that. I have one last issue. I have another server which is running hyper-V, remote access gateway, IIS and WSUS but this server is listed as a 'Name Server' on our main DC within DNS although it is not a DC and does not have DNS roles etc. It is also not listed in the Domain controllers OU. Am I right to assume that a name server would be running DNS? If so could it be that this server was once a DC and has been demoted in the paste or possible given the same name as an old DC. Should I remove this from DNS 'Name Servers' list?
edutech4schools Posted November 25, 2014 Author Posted November 25, 2014 In addition to my last post above theserver that does not have DNS etc but is listed as a 'Name Server' is also listed in AD sites and services as a server, but it does not have any NTDS settings associated with it like the other servers do. Should I remove it from this also?
3s-gtech Posted November 25, 2014 Posted November 25, 2014 It may well have hosted DNS, or another server with the same name did. Should be safe to remove it from there. Check your DNS also to see if it's listed as such. Yup, remove it from ADSS too. You should get some reliability/speed improvements for doing this work too IME. 1
edutech4schools Posted November 25, 2014 Author Posted November 25, 2014 Thanks for all your help. When I go to delete the server from DNS 'Name Servers' list, it is asking if I want to delete the glue record. Should I do this?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now