Final Checklist before Switching off!

[Joanne]

OK so I've got a 2008 R2 server that I want to retire. It was the primary domain controller and I have set up a new server which has all of the roles installed and I have transferred FSMO roles to.

 

HOWEVER - if the old server is off.... things sloooooooow right down. I mean, it was switched off during the holidays by the UPS and it messed things up for some people. I haven't demoted it yet, so it is probably still acting as a DNS server.

 

I could use a checklist of things I need to check before I demote it. Things I need to check before I switch it off. I should be transferring the last of the staff home drives in a couple of weeks.

 

Any help much appreciated!

[ITGuyWestMidlands]

Check your DHCP scopes that it isn't being set as the primary DNS server for your clients

 

Make sure servers and other devices with a static IP are updated also.

 

Check your web filter as it may point to a single server for user authentication.

[Joanne]

DHCP is dishing out new server IP as DNS. I've gone through most statics.... I'll triple check them all though!

[computer_expert]

Check logon scripts, go though GPOs and make sure you haven't got anything hardcoded (software deployment MSIs/SW deployment scripts etc) pointing towards the old server.

[DannyG555]

After demotion I usually like to comb through DNS just to ensure there aren't any records that still point to the old server as being a domain controller (SRV records).

[ITGuyWestMidlands]

Check applocker rules for your new dcs

[HPlum78]

I would look at what network traffic is coming into the DC you can then determine what might be the cause of the slow down. This may help:-

https://blogs.technet.microsoft.com/askpfeplat/2013/12/15/domain-and-dc-migrations-how-to-monitor-ldap-kerberos-and-ntlm-traffic-to-your-domain-controllers/

[HPlum78]

Oh and another thought on this, you can edit the registry and stop netlogon service registering the srv records for certain services so you can try to understand what is going on

 

HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

 

create a new multi string with the name DnsAvoidRegisterRecords and then you can add the following value(s):-

Dc

Pdc

Gc

GcAtSite

GenericGc

GenericGcAtSite

GcIpAddress

Kdc

KdcAtSite

Ldap

LdapAtSite

LdapIpAddress

Rfc1510Kdc

Rfc1510KdcAtSite

Rfc1510UdpKdc

Rfc1510Kpwd

Rfc1510UdpKpwd

 

you can see that this worked by restarting the netlogon service on the DC in question and checking DNS to see if the SRV records have been removed. You may find that as you do this the slowness that you are experiencing starts when you add certain keys.

Edited April 9, 2018 by HPlum78

[itwasntme]

if the old server is off.... things sloooooooow right down.

 

I know it can be hard to narrow things down sometimes, but could you be more specific?

What roles/features are still installed/enabled/in use on the server? Any chance that it is still providing dns forwarding for your new DC?

[Joanne]

Yeah it is for sure the DNS. It is still a domain controller, so has DNS and ADDS. I'm assuming I can switch all this off, but it's file server role will remain in tact?

[itwasntme]

Ok so before powering the server off (deleting the VM/wiping the physical tin or whatever other plans you have for the 'box') for good, better to demote (dcpromo) the server to a member server and safely remove the other roles too, first.

 

Double check that your new DC is not using the old DC for DNS forwarding, and doubly check that the new DC (and any other servers for that matter) are not using your OLD DC for dns lookups.

[andyturpie]

This may help Joanne https://social.technet.microsoft.com/wiki/contents/articles/50925.active-directory-checklist-for-decommissioning-a-domain-controller.aspx

[Joanne]

Thanks everyone, this is really helpful. It's probably not going to happen for a couple of weeks yet, but the more info I have now the better!

[andyturpie]

Yeah it is for sure the DNS. It is still a domain controller, so has DNS and ADDS. I'm assuming I can switch all this off, but it's file server role will remain in tact?

 

I have never been it this situation, but I am thinking you just switch off each of the unnecessary services and demote and as long as you don't rename the server or move your shares around the place then file server role will continue...

 

Good Luck!