Welcome back. In the previous videos I looked at installing Active Directory. In this video
I will look at removing Active Directory. In the simplest case this involves demoting
a Domain Controller back to a member server. This will cleanly remove the Domain Controller
from the domain. When possible you should use this approach.
As long as there are other domain controllers in your domain, making sure at least one is
a global catalog server, you can add and remove domain controllers from the domain as often
as you like. If, however, the domain controller is the last domain controller in the domain,
this will remove the domain entirely and with it the Active Directory database for that
domain.
If the domain is a child domain, the root domain and other child domains will still
function as normal. Removing child domains is a common practice when you migrate users
from child domains to the other domains. Perhaps the child domain was created due to a previous
limitation or for reasons that no longer exist and thus the decision was made to merge domains
together. The process of changing a Domain Controller
back into a member server or standalone server is called demoting the server. To demote a
Domain Controller the same tool is used as to promote it, DCPromo. In some cases the
domain controller hardware may have failed and you will not be able to run DCPromo. If
this is the case, refer to our other video on seizing operation master roles to see how
to manually remove a failed Domain Controller from Active Directory.
Before you decide to demote your domain controller, check to see if the domain controller is holding
any of the operational master roles. The quickest way to do this is to run the command NetDom
query FSMO. If an operational master role is present on the Domain Controller, DCPromo
will automatically transfer the role to another Domain Controller. It is best to manually
move the operational master role yourself if you want to control to which Domain Controller
the operational master role goes. See our previous video on how to move operational
master roles around. Before you remove the domain controller you
should next check that you have enough global catalog servers in your domain. You have to
have at least one, but you should always have more for redundancy. Also consider what effect
removing a global catalog server will have on your network. Clients that are using that
global catalog server will instead have to go to a different global catalog server. If
this global catalog server is over a wan link, this can have a big effect on response time
to the clients. In this video I will remove the last domain
controller from a child domain. This will effectively remove the domain from the forest.
Before doing this you should understand this will remove the Active Directory Database
and along with it anything stored in the database. This includes certificates, group policies,
and user and computer accounts. You should ensure that you have exported everything that
you need before retiring the domain. What I like to do before removing a domain
like this is to shut down the last Domain Controller for a week or so before hand. This
should be long enough to find any problems that may have been missed before removing
the Domain completely. I will now change to my Windows Server 2008 Domain Controller to
demonstrate how to remove a child domain. Before I demote this Domain Controller to
a member server and effectively remove the east ITFreeTraining domain, I want to check
if any Operational Master Roles are present on this domain controller. To do this, I will
run NetDom query FSMO from the command prompt. Since this is the last Domain Controller in
the domain, all the domain wide operational master roles will be on this Domain Controller.
I have also transferred the Domain Naming Master and Schema Master forest Wide Roles
to this domain controller as well. When the server is demoted the Schema Master
and Domain Naming Master will automatically be moved to another Domain Controller. You
should, however, perform this step yourself to have some control over to which Domain
Controller these operational master roles will be moved.
To demote the Domain Controller to a member server, I will run DCPromo from the start
menu. Once I get past the welcome screen, I will get a warning telling me this Domain
Controller is a global catalog server. Before you demote a Domain Controller you should
ensure you have enough global catalog servers on your network.
On this screen you are given a tick box asking if this is the last domain controller in the
domain. In this case this Domain Controller is. You would also tick this box if you had
failed Domain Controllers that you were not bringing back online again and this was the
last functional Domain Controller. Be aware that by ticking this box you are
effectively removing this domain and the Active Directory database completely. This includes
users, computers, keys and group policies, anything that has to do with this domain.
If you have keys like EFS keys stored in Active Directory, you should export these keys first.
On the next screen you need to enter in a username and password for an administrator
in the enterprise admin group. Since this is a child domain, changes need to be made
in the root domain as well to ensure the root domain knows the child domain is being removed.
The next screen will ask you for a local Administrators account password. Remember that when you promote
a server to a Domain Controller the local accounts database is disabled. In order to
access this server once it is demoted you will need this administrators password.
That’s it. Once you press next on the summary screen, this Domain Controller will be demoted
to a standalone server and this Domain and Active Directory will be removed.
The process took just over a minute on this server. Large domain set ups will take longer.
I will skip forward in the video to the end of the wizard. Once the wizard is complete,
Windows will ask to reboot the server. After the reboot, you will need the Administrator’s
password that you entered in the wizard to access the server.
That’s it for removing domains and demoting Domain Controllers. In the next video I will
look at trusts. Trusts in a multi-domain environment allow your users to access resources in other
domains seamlessly. Thanks for watching this free video in this
completely free course on Active Directory. See you next time.