Background
When attempting to demote a Windows 2012 Domain controller I encounter the following warning:
No other domain controller could be contacted, but other domain controller objects are in the directory. If you are certain that this is that last domain controller for the domain and want to proceed, confirm that this is that domain controller in the domain.
However, this is not the last domain controller for the domain.
If I check Force the removal of this domain controller
I am warned:
Unless this is the last domain controller in the domain, you must perform metadata cleanup manually after removal.
Question
How do I safely demote this domain controller? Why does it claim it can't contact the other domain controller? How safe is forced removal with "manual" metadata cleanup?
Update
Chasing down messages from dcdiag
, I have found that the other DC that currently holds the PDCe role does not have any SYSVOL shares, and it's \Windows\SYSVOL\sysvol\domain.example.com
is empty. I believe that is what's causing the problem, but I'm not sure how to proceed.
Further Detail
DomainMode : Windows2012Domain
ForestMode : Windows2003Forest
This domain controller was the first domain controller for the domain and as such held the InfrastructureMaster, PDCEmulator and RIDMaster roles. However, these roles were transferred using Move-ADDirectoryServerOperationMasterRole
to the other domain controller without apparent incident prior to any attempt at demotion.
The domain controller is a Global Catalog and an AD DNS server, as is the other domain controller, which now holds the FSMO roles, as are the domain controllers for the forest.
The same warnings are not triggered on the other domain controller.
repadmin /replsummary
shows no apparent problems.
There has been no customization of the Windows Firewall. The domain controllers are on the same VLAN and no interface specific ACLs are applied along their path.
If your other DCs don't have SYSVOL shared out, then find and fix the problem with your NTFRS or DFS-R. Maybe you had a rollover. You should have events related to the problem, unless they've aged out of your event viewer.
REPADMIN won't show this, it's only AD replication and doesn't have anything to do with SYSVOL replication.
Running AD Users and Computer, right clicking the dc, and selecting delete is fairly safe. Done it a hundred times.