Printable View
Gotta question for you guys...
W2k Server acting as a DC (not the only DC)...
I need to demote it, but cannot due to replication problems it seems, as it cannot contact the other DC thus rendering dcpromo unusable...
I've been told there's a way to demote manually in such a case by altering various entries through Active Directory...
Can anyone point me in a direction regarding how to do this?
Demoting manually show be your last idea, it's not that easy and can cause you a lot of problem. In Win2003, their a utilities. I read it somewhere but I cannot find it now. Give me some time and I'll find it.
What stop your server to contact your other DC? Firewall? Did this DC replicate with the AD in the last 60 days? Could you move the server physically in the same LAN that another DC?
I don't know...If you look at some of my past threads, this has been a problem for a while. It's because of problems like this that it's getting demoted...It seems to be spreading the problem across the network...Quote:
What stop your server to contact your other DC?
Nope, I don't believe so.Quote:
Did this DC replicate with the AD in the last 60 days?
Not sure I know what you mean...Could you rephrase?Quote:
Could you move the server physically in the same LAN that another DC?
Yeah, anything you can find will be MUCH appreciated. Thanks!
If your DC didn't replicate within 60 days, it's doom. Don't try to reconnect it to your AD. Was your DC as Operation Master for Schema, RID, PDC or Infrastructure?
I'm not sure but the DC might be already gone from your AD since it didn't replicate for the last 60 days. You might have problem because your DC was Operation Master for Schema, RID, PDC or Infrastructure. Try looking for a utilities call NTDSUTIL from Microsoft to move those operation master job from a death DC to a new DC. It exists for Windows 2003 Domain so I may exist for W2K Domain.
No can do.
I get this error:
Quote:
DsBindW error 0x80090322(The target principal name is incorrect.)
Was your DC as Operation Master for Schema, RID, PDC or Infrastructure?
SDK has a good point about moving it to a LAN where another DC resides. Hear me out this sounds goofy but... it works (sometimes). IN a nutshell... MS usess all kinds of funky crap to communicate with it's services, not just your basic TCP/IP. Things could get in the way if you don't have a clear path, bad hubs, switches, bridges, firewalls and bottle necks etc. So you take a DC one night and plug it right into the exact same hub that the good DC is on. And troubleshoot from there. Sounds goofy but at this point with all the stuff you have done it could be a problem with the LAN or TCP/IP stack. NEVER rule out layer 2 problems.Quote:
Not sure I know what you mean...Could you rephrase?
SDK - if all the roles are on the other DCs can't he just pull the plug and RIP the box and start over with a fresh install?
AD is configured to flush any entry that are older that 60 days. Is DC entry are probably flush already. In my view, he could just shutdown the box and wait to see the result. But we need to be sure that is DC is not an Operation Master for Schema, RID, PDC or Infrastructure.
Darn it. This DC was set up before I took over the network, so I wasn't there when the ops master roles were handed out. Asked the guy who did it, and he doesn't recall...
So how can I find out? I think I recall a DOS tool that I can use to scan for where roles reside throughout the network, right?
Open Active Directory Users and Computer, right click on your domain name and click on Operations Masters. You'll see. Usually, the first DC of a domain take those job and are rarely change on in small business AD.
Ah, thanks, now I remember...I had done this a couple of weeks ago...
The server in need of demotion holds RID, PDC, and Infrastructure roles.
What's interesting is under each role it says "The current operations master is offline. The role cannot be transferred."
Ok! You'll need the command-line tool call NTDSUTIL. Are you W2K domain or Windows 2003 domain?
Everything's W2k, and I do indeed have that tool! Installed it recently in fact!
FYI for anyone else reading this...the vast majority of these tools can be found for download HERE.
Good Luck then.
So I'm still running into this error when trying to connect to the server via NTDSUTIL to seize roles:
Any idea on that by chance?Quote:
DsBindW error 0x80090322(The target principal name is incorrect.)
Nice site... make sure to scan them all first. ;)
It worked! I finally managed to transfer all the roles to the other DC.
Which leaves me with a new problem...
MS support page says that the global catalog server cannot also hold the infrastructure role. However, once I demote this DC, I'll only have one DC on the network...so I won't have another server to assign the role of insfrustructure to. So is that bad?
If I'm not mistaken, Global Catalog server is only use in forest and forest are only created when you make a trust link between 2 top level AD.
I don't beliece M$ then they said global gatalog cannot be on the same DC that infratructure. When you created your domain, you only have one DC.
To force a DC to be a global catalog, go in the NTDS settings of your DC from your Active Directory Sites and Services Concole. You'll see it there. (In Windows 2003 at least).
Ok, I suspected as much...
Argh, so close! I'm almost there! BUT, after resetting the password via netdom and restarting the server, I'm still getting this error that's preventing dcpromo from working and demoting the DC:
I shouldn't still be getting that "Access is denied" error...I already reset the password with netdom (followed this) so that both DCs can talk to each other...Quote:
The operation failed because: The Directory Service failed to replicate off changes made locally. "Access is denied. "
Don't bother with dcpromo. If a DC didn't replicate for 60 days, he should be remove from the AD database. Just fdisk the server (Or power it off for a few days to see how it's going)
By curiosity, did you look your event viewer about replication error?
Oh yaeh, that's a long story...there's more replication errors there than you can shake a stick at...
I'll give that a try then. Thanks!