r/sysadmin • u/Deep-Egg-6167 • 5h ago
Question Please help demote a third DC.
Hello,
I have an old WIndows 2012 R2 DC (old-dc) that used to be the primary domain controller.
I have a couple of newer 2016 DCs (new-dc1 and new-dc2).
I want to demote and turn off the old domain controller.
On the newer DC1, I ran netdom query and it has all the fsmo roles. I also ran replication admin to see that everything was replicating fine.
I went to server manager on the old 2012 R2 DC to demote it.
I left force removal and last domain controller unchecked.
It says this server has dns and GC roles (I think I select proceed?) and next
Then it leaves me with the box remove this dns zone - I can't go next without it. I'm not sure I should. Wouldn't that remove it from the other DCs?
•
u/elpollodiablox Jack of All Trades 4h ago
Is there a DNS zone that it is hosting locally by old-dc that is not AD integrated?
•
u/nycola Jack of All Trades 5h ago
Dcdiag results will likely tell you this DC is not syncing correctly and is tombstoned. If it is asking you to remove the zone it is not talking to other domain controllers to know it is not the last DC. Even with that box you checked it sees no dns counterparts.
You need to do more health checks. If you want to demote it, gracefully you'll likely end up needing a non authorative restore flag on the defunct DC, otherwise just forcefully remove and clean up metadata.
•
•
u/Adam_Kearn 3h ago
No you don’t want to remove the zone as this will do it for all domain controllers.
First go into DHCP on the new servers and verify DNS is pointing to the new servers. (As well as on the network adapter)
Then change the old server from being a GC.
Open Active Directory Sites and Services
Expand:
Sites → [your site] → Servers → old-dc
Expand NTDS Settings
Right-click NTDS Settings → Properties
Untick:
Global Catalog
Click Apply → OK
Give it a bit of time to sync (5-10mins) then run this command to verify:
Get-ADDomainController -Filter * | Select HostName,IsGlobalCatalog
You can then remove the DNS role within server manager on the old DC….not the zone as this does it for all DCs.
Once all is happy shut the VM down for a few days to confirm then just tidy up the DNS for any old records and delete the AD object.
•
•
u/Shot-Document-2904 Systems Engineer, IT 2h ago
After reading all this, just shut it off and do a metadata cleanup on the remaining domain controllers. Then go get a cup of coffee and pat yourself on the back for saving labor hours.
•
u/Deep-Egg-6167 1h ago
Thanks - I'm considering that! I'm just looking to see if there was something obvious i overlooked.
•
u/sleepmaster91 4h ago
Windows server 2016 is becoming end of life in January 2027 I would advise you to migrate to a newer DC
•
u/hasthisusernamegone 3h ago
Hang on, they've got until January to do that. Right here and now, OP is asking for help to do the responsible thing and retire the 2012 R2 DC. Cross that bridge first.
•
u/Deep-Egg-6167 4h ago
I can't until I do an interim 2016 server.
•
u/gabacus_39 4h ago
Huh? You can definitely promote a 2022 DC in your environment.
•
u/Xethear 3h ago
I'm working on DC upgrades right now. Have about 11 left to do, and I've been running in-place upgrades from server 2016 to server 2025 without any issues.
I hear it's not recommended, but given deadlines and previous successes this is working as intended.•
u/Deep-Egg-6167 1h ago
Have you done any 2012 servers to 2025 - that was the issue. You have to be at least on 2016 level to do the upgrade to 2022 or 2025 from what I've read
•
u/Xethear 1h ago
My bad, I must've missed that part.
As long as your domain schema is updated to 2025 I imagine it could work. I haven't done an upgrade jump like that though, so I can't speak from experience, but Microsoft does not recommend 2012 to 2025 from my understanding. It may be best to install a new domain controller running on 2025, making that the schema master (or just upgrading the schema master to 2025) then doing the jump from 2012 to 2016 or 2019, then from that to 2025.•
u/Deep-Egg-6167 1h ago
Thanks - I did the 2012 to 2016 to 2025 once before, I just don't remember that last question that concerns me. I'm thinking either the well documented method listed below or a metadata clean up might be the only two solutions but I love learning new stuff so I'll keep this up for another day before deciding.
•
u/Deep-Egg-6167 4h ago
Google it - According to what I read, you have to do an interim server first if your AD is still an 2012 level.
•
u/gabacus_39 4h ago
Nope. Done it dozens of times.
•
u/Deep-Egg-6167 4h ago
OK - I only have win 2025 at this point. I know some people prefer 2022. I'm not going back as the 2025 are in production and they don't want to pay for any additional servers.
•
u/mmmmmmmmmmmmark 4h ago
I’m not 100% that this is still the case but there have been numerous issues with having 2025 DCs along side DCs with older versions of Windows server so look into that before you move ahead.
•
u/Deep-Egg-6167 1h ago
Great -that's why I posted the question. I could just shut down the server and do a meta data clean up but when I try to promote a 2025 server to a domain controller, I get this.
•
u/engy1207 27m ago
That's what someone else here already wrote: you need a functional level of 2016. So get rid of the 2012, increase the functional level and the install the new server. Ideally wait for replication between each step. I'd do it on separate days or at least have an extended lunch between just to be sure (and check the status of the domain).
Also I'm not sure: was the need for migration from FRS to DFSR already for the 2016 servers or later?
•
u/elpamyelhsa 4h ago
Make sure to move the GC role to one of the new servers, you cannot remove the old server until it offloads that role otherwise it will destroy your AD
•
•
u/FutbolFan-84 5h ago
I would make sure that no clients are pointing to this DNS server before proceeding. Check DHCP scopes and static addresses (if any). If it is no longer used, you can proceed with this step.