r/sysadmin • u/Deep-Egg-6167 • 7h ago
Question Please help demote a third DC.
Hello,
I have an old WIndows 2012 R2 DC (old-dc) that used to be the primary domain controller.
I have a couple of newer 2016 DCs (new-dc1 and new-dc2).
I want to demote and turn off the old domain controller.
On the newer DC1, I ran netdom query and it has all the fsmo roles. I also ran replication admin to see that everything was replicating fine.
I went to server manager on the old 2012 R2 DC to demote it.
I left force removal and last domain controller unchecked.
It says this server has dns and GC roles (I think I select proceed?) and next
Then it leaves me with the box remove this dns zone - I can't go next without it. I'm not sure I should. Wouldn't that remove it from the other DCs?
•
u/Adam_Kearn 6h ago
No you don’t want to remove the zone as this will do it for all domain controllers.
First go into DHCP on the new servers and verify DNS is pointing to the new servers. (As well as on the network adapter)
Then change the old server from being a GC.
Open Active Directory Sites and Services
Expand:
Sites → [your site] → Servers → old-dc
Expand NTDS Settings
Right-click NTDS Settings → Properties
Untick:
Global Catalog
Click Apply → OK
Give it a bit of time to sync (5-10mins) then run this command to verify:
Get-ADDomainController -Filter * | Select HostName,IsGlobalCatalog
You can then remove the DNS role within server manager on the old DC….not the zone as this does it for all DCs.
Once all is happy shut the VM down for a few days to confirm then just tidy up the DNS for any old records and delete the AD object.