question

cognic avatar image
0 Votes"
cognic asked DSPatrick answered

demoting 2008 R2 active directory domain controllers

We are planning to demote 2(total 8 DC's) 2008 R2 domain controllers(virtual) and following are some notes:

We don't have DNS hosted on AD (External, on Infoblox)
Same with DHCP, on infoblox
No FSMO roles on these 2
These are not DFS name space servers
Not ADFS, KMS or CA hosted on these
We came across the following article for an impact analysis: https://social.technet.microsoft.com/wiki/contents/articles/50925.active-directory-checklist-for-decommissioning-a-domain-controller.aspx

One of the action plans suggests to power off the domain controllers for 1 or 2 weeks to remediate any dependencies (after impact analysis) and then demote and decommission the server eventually.

These 2 seemed to be the first domain controllers in the company.

Based on your experience, do you see any issues with powering off dc's for 2 weeks? We won't remove the SRV records until they are decommissioned but powering the dc's off will create any slowness in authentication or something?

We also have Linux servers using LDAP but I am not sure if they will have any impact.

Please suggest if there are any precautions or steps to take care before we commence the decommission

Thank you in advance!

windows-active-directorywindows-server-infrastructure
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi,
 
Just want to confirm the current situations.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,

0 Votes 0 ·
DSPatrick avatar image
0 Votes"
DSPatrick answered

Shouldn't be a problem to do this. In the end if the demotion is problematic you can remove from network then easily perform cleanup to remove them.
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564

--please don't forget to Accept as answer if the reply is helpful--



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered

Hi,

Before doing any critical changes in domain, remember to back up the DCs.
Check other DCs are working well through the following command.

Dcdiag /v >c:\dcdiag1.log
Repadmin /showrepl >C:\repl.txt
Repadmin /showreps * 
If there are no errors, you can demote the 2 DCs one by one. Then you can keep them as the domain members in the domain or remove them from the domain.

Or you can do as the mentioned above: Shut down the 2 DCs and monitor for one or two weeks.
If everything works well, you can remove the 2 DCs safely.

Best Regards,

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick avatar image
0 Votes"
DSPatrick answered

Just checking if there's any progress or updates?

--please don't forget to Accept as answer if the reply is helpful--


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.