DCPROMO fails

[Jobos]

So I'm trying to remove AD from an old 2003 server. All the FSMO roles have been moved to another server but when I run DCPromo it gives the error failed to configure the service netlogon as requested.

 

Any advice please?

[featured_spectre]

Did you demote the old server first?

[Jobos]

I would guess that the error message is from the server he is trying to demote?

That's correct.

[Jobos]

Did the server you are trying demote hold the DNS role? If so is it pointing to the new DNS server(s)

Yes and it's still got DNS installed and the network settings are still pointing to itself. DNS is installed on the other servers.

[dhomer]

Hi,

 

Funny that I had this problem this week.

 

Can you try rebooting then check your DNS settings and make sure these are correct and point to valid DNS servers I found the secondary DNS was pointing to an invalid server. I went with a single DNS entry to a known good DNS server and tested with NSLOOKUP.

 

If this doesn't work try stopping the netlogon service manually and check the Event Log.

 

 

 

Thanks,

 

 

Dave

 

CENTREL Solutions

[Jobos]

Seeing as you have other DNS servers you could try removing the DNS role and then point it to the other DNS Server(s) and rerun dcpromo.

I don't know why but that did the trick, DCPromo removed AD without any problems.

[jamesb]

I don't know why but that did the trick, DCPromo removed AD without any problems.

 

It's to do with the advertising of domain services in DNS I believe - since the controller's demoting itself, it doesn't trust itself to provide it's own domain services. Just pointing DNS to another DC should have fixed it.

 

I could be wrong though.

[Michael]

This could of been related to DNS Zone Transfers. When you run dcpromo to demote a server, the process involves migrating DNS settings and other critical domain information. Although removing the DNS role works, it's generally not recommended. You should be able to demote a DC with AD and DNS without any issues.

 

I would check that all Forward and Reverse DNS Lookup Zones have replicated. If not, then just re-create them manually.