Home / server / Questions / 408900
Accepted
Christopher Williams
Asked: 2012-07-19 08:31:15 +0800 CST

Demoted 2003R2 DC SRV record still listed in DNS

  • 772

Yesterday I demoted a 2003R2 DC (but forgot to remove the DNS role), removed it from the domain, changed it's IP address and shut it down. Everything went pretty well (minus a host of authentication issues across the domain until I added the old IP for this DC to it's replacement 2008R2 DC) but I'm still seeing four SRV records in DNS for this DC. DNS is still showing _ldap SRV records for DC1, one each under:
DomainDNSZones->_sites->Default-First-Site-Name->_tcp
DomainDNSZones->_tcp
ForestDNSZones->_sites->Default-First-Site-Name->_tcp
ForestDNSZones->_tcp

DC1 is not listed under any other zone including _msdcs.

Can I simply delete these _ldap SRV records for the demoted DC?

domain-name-system windows-server-2008-r2 srv-record windows-server-2003-r2

3 Answers

  1. Best Answer

    This might be indicative of a replication problem in your environment. You should use repadmin and dcdiag to make sure that there aren't replication problems. If there aren't you might consider using ntdsutil to do a metadata cleanup since it sounds like the demotion might not have happened cleanly despite the wizard's completion.

    In all likelihood, you are safe to just delete the offending SRV records, but they may be the tip of the iceberg for a larger problem. Better safe than sorry.

    • 5

  2. Remove them!

    Let's say a client needs to locate an ldap endpoint in the Default-First-Site-Name site.

    NetLogon queries its DNS server for 

    _ldap._tcp.Default-First-Site-Name._sites._msdcs.<domain-fqdn>

    to acquire information about such a service. DC1 is returned, and the client tries to resolve DC1, and has to wait for the query to either timeout or return false.

    Now it can start the process over, and the old records thus resulted in degraded performance ;-)

    • 3

  3. If you're not using that server for DNS and your hosts don't have to make service requests you can delete the records, or simply uninstall DNS

    • 1