Corrupt Domain Controller

[Gibbo]

I've just spent the day getting a corrupted server back up and running.

 

However, it's now clear that there is some faults with the domain controller (plenty of errors in the log and any changes made to AD are not showing on the other domain controllers).

 

It's clear I need to demote this server, but how can I be sure that this is the last domain controller in the domain?

 

I've been looking at this thread:

 

http://www.edugeek.net/forums/windows/6752-corrupt-ad-help.html

 

and it seems that I may need to seize the roles to another controller. How can I tell what roles each domain controller has?

 

There are two other working DCs on my network, this one which has failed is the oldest and I'm not sure what the previous NM did regarding the roles.

 

I was planning on phasing out this old DC at the end of this year (during the last week of term while everyone's watching DVDs!), but the hardware failure has brought things forward somewhat.

 

TIA

[Gibbo]

Just found a bit more info. By going to AD on a good domain controller, right clicking the domain name and then clicking "Operations Masters", all the entries point to a "good" working server.

[FN-GM]

Just found a bit more info. By going to AD on a good domain controller, right clicking the domain name and then clicking "Operations Masters", all the entries point to a "good" working server.

 

you will also need to check in sites and services. If it is a good on in there you can uninstall DNS and demote the server. Also check that your clients wont be point to this server for DNS.

 

How many DC's will you have once this has gone?

[Geoff]

You need to get that domain controller out of there as soon as possible. Depending on the nature of the problem, you're running the risk of it corrupting AD and replicating the corrupt data to your 'good' AD controllers.

[Gibbo]

The faulty server is only running IIS and as a DC. Once I demote it I'll have two other domain controllers remaining.

[ChrisH]

I would make sure the failing controller is disconnected from the network so its not upsetting the other 2. Seize the roles if you have to. You can google how to find what has which role. You can see most of them through the GUI or you can use NTDSUTIL. Theres a good KB here How To Find Servers That Hold Flexible Single Master Operations Roles

[Gibbo]

Right, I'm fairly confident I can remove it.

 

Just to confirm, I do NOT tick the box "This server is the last domain controller in the domain"?

[FN-GM]

Right, I'm fairly confident I can remove it.

 

Just to confirm, I do NOT tick the box "This server is the last domain controller in the domain"?

 

god no that we wreck the whole AD.

 

I would just unplug the server and remove it manually from AD, DNS and Active Directory of Sites and Services.

[Gibbo]

The only thing which concerns me is removing the DC role while the machine is not on the network.

 

I would have thought having it connected to the network would notify the other DCs that the server is being demoted?

 

Edit: Once again, I find out information after I post.

 

During the decommissioning process, the Active Directory Installation Wizard will attempt to transfer any remaining operations master roles to other domain controllers without any user interaction. However, if a failure occurs, the wizard will continue to uninstall Active Directory and leave your domain without roles. Also, you do not have control over which domain controller receives the roles. The wizard transfers the roles to any available domain controller and does not indicate which domain controller hosts them.

 

From: http://technet.microsoft.com/en-us/library/cc755937.aspx

[FN-GM]

The only thing which concerns me is removing the DC role while the machine is not on the network.

 

please can you explain more

[Gibbo]

Well, the machine is not connected to the network, but when I try and demote it I get the error "The operation failed because a domain controller could not be contacted or the domain that contained an account for this computer."

 

It suggests I make the machine a member of a workgroup then rejoin it to the domain before retrying.

 

Step 7 of this article: http://technet.microsoft.com/en-us/library/cc755937.aspx

[FN-GM]

ah you will get that as it cant contact AD on the PDC

 

I would remove it manually if that is the case

 

Z

[ChrisH]

As me and Geoff have said keep it off the network. Pretend it has gone up in smoke and is a molten mess of plastic and metal. Remove it from Active directory by deleting its account. There are some other clean up steps you can perform and these are well documented. You are potentially risking messing up your whole AD if its spewing out crap.

[Gibbo]

Grr, manual removal isn't working either "Error: The connected server will not remove its own metadata"

 

It's not a problem to keep the machine off the network for good. Can anyone suggest any good instructions for removing the entries for this server from the good remaining DCs?

[FN-GM]

are you doing that on a good DC?

[ChrisH]

You will need to look at some NTDSUTIL guides to do the necessary clean up. Google something like

ntdsutil remove a dead dc

[Gibbo]

are you doing that on a good DC?

 

No, I'm following this guide on the faulty server.

 

How to remove data in Active Directory after an unsuccessful domain controller demotion

 

Should I follow these steps on a good DC to remove all entries to the failed DC?

 

When the faulty DC is removed from the network it's taking the clients ages to log on but only partially runs the GP - they get some settings but are getting access to the C drive.

[jamesb]

Yep, you want all references to that server gone from the domain.

 

Microsoft best practice then states that the server that's been removed would make a good paperweight, but should never be brought back onto the domain. If you are going to then make sure all traces are gone before doing so, a complete reformat and rebuild's your best bet.

[srochford]

You are potentially risking messing up your whole AD if its spewing out crap.

 

I don't think you are at risk. AD is pretty good at not replicating "bad" data - @gibbo's comments about changes made on this DC not replicating to other DCs tends to confirm this.

 

Having said that, you might as well leave the machine disconnected. You can use dcpromo /forceremoval so that it will stop being a DC; you then just run ntdsutil - this is a good description of what to do.

[Gibbo]

Thanks for all your help guys. I've manually removed the faulty DC from the domain with KB216498, and removed all entries in DNS and DHCP relating to it.

 

I've shut down and restarted a number of random client PCs around school and so far they've logged on ok - no delays and picking up the two "good" DCs.

 

The real test will be Monday morning when everyone logs on!

[sukh]

use NTDS Util to manually remove DC form yr forest. Part of the SVR install. Once removed I would do a clean install and let yr DC update through replication. I'm assuming that all yr DC's have high speed link between them (1GBPS)

 

Use NTD Util to comfirm if all enteries for the corrput DC have been reomved, check yr svr locator records too.