Re: Re: [ActiveDir] remove orphan DC from the domain
XFER = Short for transfer. Sorry, I abbreviate most things.
Basically, in k3 SP1, if you run the metadata cleanup command on a dead DC that
holds FSMO roles, the process will seize the roles to another server. I'm not
sure of the exact logic for the choice of server, IIRC it's something like
local (site) and GC (unless it's the IM). Dmitri, Brett, Eric, Dean or Joe can
clarify the logic.
I would imagine it's using the same underlying code as the Seize option
elsewhere with the tool, therefore it will try a TRANSFER first and only SEIZE
if the transfer fails.
http://technet2.microsoft.com/WindowsServer/en/library/819bea8b-3889-4479-850f-1f031087693d1033.mspx?mfr=true
--Paul
- Original Message -
From: Yann
To: ActiveDir@mail.activedir.org
Sent: Friday, January 26, 2007 8:43 AM
Subject: RE : Re: [ActiveDir] remove orphan DC from the domain
Really ?
That is a very interesting... Could you develop this statement please ? What
is a XFER ?
When you say "it does a seize", that means it choose a DC nearby ? and seize
*automatically* a seizure ?
Thanks,
Yann
Paul Williams <[EMAIL PROTECTED]> a écrit :
> If the DC that died had FSMO roles, you need to seize them (check which
> DC had FSMO roles with --> NETDOM QUERY FSMO)
This step is no longer necessary in k3 SP1. NTDSUTIL does it for you. If I
remember correctly, it tries a XFER and then does a Seize (as that's the
logic for the Seize anyway).
I believe this was added in SP1.
--Paul
- Original Message -
From: "Almeida Pinto, Jorge de"
To:
Sent: Friday, January 26, 2007 7:05 AM
Subject: RE: [ActiveDir] remove orphan DC from the domain
I forgot to mention:
* If the DC that died had FSMO roles, you need to seize them (check which
DC
had FSMO roles with --> NETDOM QUERY FSMO)
* DNS records are NOT removed by the NTDSUTIL. Must be done manually or
wait
if you have aging/scavenging enabled
Also make sure the GC role and DNS roles is hosted by other computers
(other
DCs)
Met vriendelijke groeten / Kind regards,
Ing. Jorge de Almeida Pinto
Senior Infrastructure Consultant
MVP Windows Server - Directory Services
LogicaCMG Nederland B.V. (BU RTINC Eindhoven)
( Tel : +31-(0)40-29.57.777
( Mobile : +31-(0)6-26.26.62.80
* E-mail :
From: [EMAIL PROTECTED] on behalf of senthil Kumar
Sent: Fri 2007-01-26 01:00
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] remove orphan DC from the domain
Thanks for your logic. I hope so in the remaining Dc it will do
automatically.
Regards,
Senthil
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Almeida Pinto,
Jorge de
Sent: Friday, January 26, 2007 5:10 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] remove orphan DC from the domain
the AD metadata cleanup is nothing more then removal/deletion of objects
that belong to a DC that is not live anymore. Just other like other object
deletions (user, group, etc) the deletions will replicate to other DCs
(assuming replication is working fine) that host the same partitions from
which the objects were removed. Because of that you only need to target ONE
live DC in the same domain when using NTDSUTIL.
Imagine a domain with a 1000 DCs It would be a PITA to cleanup the AD
metadata of one of the DCs on the other 999 DCs... ;-))
Met vriendelijke groeten / Kind regards,
Ing. Jorge de Almeida Pinto
Senior Infrastructure Consultant
MVP Windows Server - Directory Services
LogicaCMG Nederland B.V. (BU RTINC Eindhoven)
* Tel : +31-(0)40-29.57.777
* Mobile : +31-(0)6-26.26.62.80
* E-mail :
From: [EMAIL PROTECTED] on behalf of senthil Kumar
Sent: Fri 2007-01-26 00:14
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] remove orphan DC from the domain
Hi,
We already had 3 Dcs in out network. Suddenly one Dc gone down permanently.
That wont come live back. Right now we want to remove that orphan dc
completely. I have seen Microsoft article
1.
Click Start, point to Programs, point to Accessories, and then click
Command
Prompt.
2.
At the command prompt, type ntdsutil, and then press ENTER.
3.
Type metadata cleanup, and then press ENTER. Based on the options given,
the
administrator can perform the removal, but additional configuration
parameters must be specified before the removal can occur.
4.
Type connections and press ENTER. This menu is used to connect to the
specific server where the changes occur. If the currently logged on user
does no
Re: RE : Re: [ActiveDir] remove orphan DC from the domain
SP level doesn't matter when performing a seizure using NTDSUTIL.
I was referring to the fact that NTDSUTIL, as of k3 SP1, automatically tries
to transfer and seize when you metadata cleanup.
--Paul
- Original Message -
From: "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]"
<[EMAIL PROTECTED]>
To:
Sent: Friday, January 26, 2007 9:05 AM
Subject: Re: RE : Re: [ActiveDir] remove orphan DC from the domain
Just what it says... it first attempts to transfer the FSMO roles from the
one to the other...and it if can't find the proper DC.. it merely seizes
the roles.
It tries to negotiate politely with the role holder.. and if there is none
for it to argue with it says "fine... I'm taking the roles".
I'm not sure sp1 matters does it?
http://support.microsoft.com/kb/255504
Yann wrote:
Really ?
That is a very interesting... Could you develop this statement please ?
What is a XFER ?
When you say "it does a seize", that means it choose a DC nearby ? and
seize *automatically* a seizure ?
Thanks,
Yann
*/Paul Williams <[EMAIL PROTECTED]>/* a écrit :
> If the DC that died had FSMO roles, you need to seize them
(check which
> DC had FSMO roles with --> NETDOM QUERY FSMO)
This step is no longer necessary in k3 SP1. NTDSUTIL does it for
you. If I
remember correctly, it tries a XFER and then does a Seize (as
that's the
logic for the Seize anyway).
I believe this was added in SP1.
--Paul
- Original Message -
From: "Almeida Pinto, Jorge de"
To:
Sent: Friday, January 26, 2007 7:05 AM
Subject: RE: [ActiveDir] remove orphan DC from the domain
I forgot to mention:
* If the DC that died had FSMO roles, you need to seize them
(check which DC
had FSMO roles with --> NETDOM QUERY FSMO)
* DNS records are NOT removed by the NTDSUTIL. Must be done
manually or wait
if you have aging/scavenging enabled
Also make sure the GC role and DNS roles is hosted by other
computers (other
DCs)
Met vriendelijke groeten / Kind regards,
Ing. Jorge de Almeida Pinto
Senior Infrastructure Consultant
MVP Windows Server - Directory Services
LogicaCMG Nederland B.V. (BU RTINC Eindhoven)
( Tel : +31-(0)40-29.57.777
( Mobile : +31-(0)6-26.26.62.80
* E-mail :
From: [EMAIL PROTECTED] on behalf of senthil Kumar
Sent: Fri 2007-01-26 01:00
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] remove orphan DC from the domain
Thanks for your logic. I hope so in the remaining Dc it will do
automatically.
Regards,
Senthil
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Almeida
Pinto,
Jorge de
Sent: Friday, January 26, 2007 5:10 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] remove orphan DC from the domain
the AD metadata cleanup is nothing more then removal/deletion of
objects
that belong to a DC that is not live anymore. Just other like
other object
deletions (user, group, etc) the deletions will replicate to other
DCs
(assuming replication is working fine) that host the same
partitions from
which the objects were removed. Because of that you only need to
target ONE
live DC in the same domain when using NTDSUTIL.
Imagine a domain with a 1000 DCs It would be a PITA to cleanup
the AD
metadata of one of the DCs on the other 999 DCs... ;-))
Met vriendelijke groeten / Kind regards,
Ing. Jorge de Almeida Pinto
Senior Infrastructure Consultant
MVP Windows Server - Directory Services
LogicaCMG Nederland B.V. (BU RTINC Eindhoven)
* Tel : +31-(0)40-29.57.777
* Mobile : +31-(0)6-26.26.62.80
* E-mail :
From: [EMAIL PROTECTED] on behalf of senthil Kumar
Sent: Fri 2007-01-26 00:14
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] remove orphan DC from the domain
Hi,
We already had 3 Dcs in out network. Suddenly one Dc gone down
permanently.
That wont come live back. Right now we want to remove that orphan dc
completely. I have seen Microsoft article
1.
Click Start, point to Programs, point to Accessories, and then
click Command
Prompt.
2.
At the command prompt, type ntdsutil, and then press ENTER.
3.
Type metadata cleanup, and then press ENTER. Based on the options
given, the
administrator can perform the removal, but additional configuration
parameters must be specified before the removal can occur.
4.
Type connections and press ENTER. This menu is used to connect to the
specific server where the changes occur. If the currently logged
on user
does not have ad
RE: [ActiveDir] remove orphan DC from the domain
correct! however he never mentioned the OS en SP level... ;-) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) ( Tel : +31-(0)40-29.57.777 ( Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of Paul Williams Sent: Fri 2007-01-26 09:25 To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] remove orphan DC from the domain > If the DC that died had FSMO roles, you need to seize them (check which > DC had FSMO roles with --> NETDOM QUERY FSMO) This step is no longer necessary in k3 SP1. NTDSUTIL does it for you. If I remember correctly, it tries a XFER and then does a Seize (as that's the logic for the Seize anyway). I believe this was added in SP1. --Paul - Original Message - From: "Almeida Pinto, Jorge de" <[EMAIL PROTECTED]> To: Sent: Friday, January 26, 2007 7:05 AM Subject: RE: [ActiveDir] remove orphan DC from the domain I forgot to mention: * If the DC that died had FSMO roles, you need to seize them (check which DC had FSMO roles with --> NETDOM QUERY FSMO) * DNS records are NOT removed by the NTDSUTIL. Must be done manually or wait if you have aging/scavenging enabled Also make sure the GC role and DNS roles is hosted by other computers (other DCs) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) ( Tel : +31-(0)40-29.57.777 ( Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 01:00 To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain Thanks for your logic. I hope so in the remaining Dc it will do automatically. Regards, Senthil From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Almeida Pinto, Jorge de Sent: Friday, January 26, 2007 5:10 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain the AD metadata cleanup is nothing more then removal/deletion of objects that belong to a DC that is not live anymore. Just other like other object deletions (user, group, etc) the deletions will replicate to other DCs (assuming replication is working fine) that host the same partitions from which the objects were removed. Because of that you only need to target ONE live DC in the same domain when using NTDSUTIL. Imagine a domain with a 1000 DCs It would be a PITA to cleanup the AD metadata of one of the DCs on the other 999 DCs... ;-)) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) * Tel : +31-(0)40-29.57.777 *Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 00:14 To: ActiveDir@mail.activedir.org Subject: [ActiveDir] remove orphan DC from the domain Hi, We already had 3 Dcs in out network. Suddenly one Dc gone down permanently. That wont come live back. Right now we want to remove that orphan dc completely. I have seen Microsoft article 1. Click Start, point to Programs, point to Accessories, and then click Command Prompt. 2. At the command prompt, type ntdsutil, and then press ENTER. 3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur. 4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do this, type set creds DomainNameUserNamePassword, and then press ENTER. For a null password, type null for the password parameter. 5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server. Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message: Error 2094. The DSA Object cannot be deleted0x2094 6. Type quit, and then press ENTER. The Metadata Cleanup menu appears. 7. Type select operation target and press ENTER.
Re: RE : Re: [ActiveDir] remove orphan DC from the domain
Just what it says... it first attempts to transfer the FSMO roles from
the one to the other...and it if can't find the proper DC.. it merely
seizes the roles.
It tries to negotiate politely with the role holder.. and if there is
none for it to argue with it says "fine... I'm taking the roles".
I'm not sure sp1 matters does it?
http://support.microsoft.com/kb/255504
Yann wrote:
Really ?
That is a very interesting... Could you develop this statement please
? What is a XFER ?
When you say "it does a seize", that means it choose a DC nearby ? and
seize *automatically* a seizure ?
Thanks,
Yann
*/Paul Williams <[EMAIL PROTECTED]>/* a écrit :
> If the DC that died had FSMO roles, you need to seize them
(check which
> DC had FSMO roles with --> NETDOM QUERY FSMO)
This step is no longer necessary in k3 SP1. NTDSUTIL does it for
you. If I
remember correctly, it tries a XFER and then does a Seize (as
that's the
logic for the Seize anyway).
I believe this was added in SP1.
--Paul
- Original Message -
From: "Almeida Pinto, Jorge de"
To:
Sent: Friday, January 26, 2007 7:05 AM
Subject: RE: [ActiveDir] remove orphan DC from the domain
I forgot to mention:
* If the DC that died had FSMO roles, you need to seize them
(check which DC
had FSMO roles with --> NETDOM QUERY FSMO)
* DNS records are NOT removed by the NTDSUTIL. Must be done
manually or wait
if you have aging/scavenging enabled
Also make sure the GC role and DNS roles is hosted by other
computers (other
DCs)
Met vriendelijke groeten / Kind regards,
Ing. Jorge de Almeida Pinto
Senior Infrastructure Consultant
MVP Windows Server - Directory Services
LogicaCMG Nederland B.V. (BU RTINC Eindhoven)
( Tel : +31-(0)40-29.57.777
( Mobile : +31-(0)6-26.26.62.80
* E-mail :
From: [EMAIL PROTECTED] on behalf of senthil Kumar
Sent: Fri 2007-01-26 01:00
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] remove orphan DC from the domain
Thanks for your logic. I hope so in the remaining Dc it will do
automatically.
Regards,
Senthil
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Almeida
Pinto,
Jorge de
Sent: Friday, January 26, 2007 5:10 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] remove orphan DC from the domain
the AD metadata cleanup is nothing more then removal/deletion of
objects
that belong to a DC that is not live anymore. Just other like
other object
deletions (user, group, etc) the deletions will replicate to other
DCs
(assuming replication is working fine) that host the same
partitions from
which the objects were removed. Because of that you only need to
target ONE
live DC in the same domain when using NTDSUTIL.
Imagine a domain with a 1000 DCs It would be a PITA to cleanup
the AD
metadata of one of the DCs on the other 999 DCs... ;-))
Met vriendelijke groeten / Kind regards,
Ing. Jorge de Almeida Pinto
Senior Infrastructure Consultant
MVP Windows Server - Directory Services
LogicaCMG Nederland B.V. (BU RTINC Eindhoven)
* Tel : +31-(0)40-29.57.777
* Mobile : +31-(0)6-26.26.62.80
* E-mail :
From: [EMAIL PROTECTED] on behalf of senthil Kumar
Sent: Fri 2007-01-26 00:14
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] remove orphan DC from the domain
Hi,
We already had 3 Dcs in out network. Suddenly one Dc gone down
permanently.
That wont come live back. Right now we want to remove that orphan dc
completely. I have seen Microsoft article
1.
Click Start, point to Programs, point to Accessories, and then
click Command
Prompt.
2.
At the command prompt, type ntdsutil, and then press ENTER.
3.
Type metadata cleanup, and then press ENTER. Based on the options
given, the
administrator can perform the removal, but additional configuration
parameters must be specified before the removal can occur.
4.
Type connections and press ENTER. This menu is used to connect to the
specific server where the changes occur. If the currently logged
on user
does not have administrative permissions, different credentials
can be
supplied by specifying the credentials to use before making the
connection.
To do this, type set creds DomainNameUserNamePassword, and then
press ENTER.
For a null password, type null for the password parameter.
5.
Type connect to server servername, and then press ENTER. You
should receive
confirmation that the connection is successfully established.
RE : Re: [ActiveDir] remove orphan DC from the domain
Really ? That is a very interesting... Could you develop this statement please ? What is a XFER ? When you say "it does a seize", that means it choose a DC nearby ? and seize *automatically* a seizure ? Thanks, Yann Paul Williams <[EMAIL PROTECTED]> a écrit : > If the DC that died had FSMO roles, you need to seize them (check which > DC had FSMO roles with --> NETDOM QUERY FSMO) This step is no longer necessary in k3 SP1. NTDSUTIL does it for you. If I remember correctly, it tries a XFER and then does a Seize (as that's the logic for the Seize anyway). I believe this was added in SP1. --Paul - Original Message - From: "Almeida Pinto, Jorge de" To: Sent: Friday, January 26, 2007 7:05 AM Subject: RE: [ActiveDir] remove orphan DC from the domain I forgot to mention: * If the DC that died had FSMO roles, you need to seize them (check which DC had FSMO roles with --> NETDOM QUERY FSMO) * DNS records are NOT removed by the NTDSUTIL. Must be done manually or wait if you have aging/scavenging enabled Also make sure the GC role and DNS roles is hosted by other computers (other DCs) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) ( Tel : +31-(0)40-29.57.777 ( Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 01:00 To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain Thanks for your logic. I hope so in the remaining Dc it will do automatically. Regards, Senthil From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Almeida Pinto, Jorge de Sent: Friday, January 26, 2007 5:10 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain the AD metadata cleanup is nothing more then removal/deletion of objects that belong to a DC that is not live anymore. Just other like other object deletions (user, group, etc) the deletions will replicate to other DCs (assuming replication is working fine) that host the same partitions from which the objects were removed. Because of that you only need to target ONE live DC in the same domain when using NTDSUTIL. Imagine a domain with a 1000 DCs It would be a PITA to cleanup the AD metadata of one of the DCs on the other 999 DCs... ;-)) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) * Tel : +31-(0)40-29.57.777 * Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 00:14 To: ActiveDir@mail.activedir.org Subject: [ActiveDir] remove orphan DC from the domain Hi, We already had 3 Dcs in out network. Suddenly one Dc gone down permanently. That wont come live back. Right now we want to remove that orphan dc completely. I have seen Microsoft article 1. Click Start, point to Programs, point to Accessories, and then click Command Prompt. 2. At the command prompt, type ntdsutil, and then press ENTER. 3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur. 4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do this, type set creds DomainNameUserNamePassword, and then press ENTER. For a null password, type null for the password parameter. 5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server. Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message: Error 2094. The DSA Object cannot be deleted0x2094 6. Type quit, and then press ENTER. The Metadata Cleanup menu appears. 7. Type select operation target and press ENTER. 8. Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number. 9. Type select domain number and press ENTER, where number is the number associated with the domain the server you are removing is a member of. The dom
Re: [ActiveDir] remove orphan DC from the domain
If the DC that died had FSMO roles, you need to seize them (check which DC had FSMO roles with --> NETDOM QUERY FSMO) This step is no longer necessary in k3 SP1. NTDSUTIL does it for you. If I remember correctly, it tries a XFER and then does a Seize (as that's the logic for the Seize anyway). I believe this was added in SP1. --Paul - Original Message - From: "Almeida Pinto, Jorge de" <[EMAIL PROTECTED]> To: Sent: Friday, January 26, 2007 7:05 AM Subject: RE: [ActiveDir] remove orphan DC from the domain I forgot to mention: * If the DC that died had FSMO roles, you need to seize them (check which DC had FSMO roles with --> NETDOM QUERY FSMO) * DNS records are NOT removed by the NTDSUTIL. Must be done manually or wait if you have aging/scavenging enabled Also make sure the GC role and DNS roles is hosted by other computers (other DCs) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) ( Tel : +31-(0)40-29.57.777 ( Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 01:00 To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain Thanks for your logic. I hope so in the remaining Dc it will do automatically. Regards, Senthil From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Almeida Pinto, Jorge de Sent: Friday, January 26, 2007 5:10 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain the AD metadata cleanup is nothing more then removal/deletion of objects that belong to a DC that is not live anymore. Just other like other object deletions (user, group, etc) the deletions will replicate to other DCs (assuming replication is working fine) that host the same partitions from which the objects were removed. Because of that you only need to target ONE live DC in the same domain when using NTDSUTIL. Imagine a domain with a 1000 DCs It would be a PITA to cleanup the AD metadata of one of the DCs on the other 999 DCs... ;-)) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) * Tel : +31-(0)40-29.57.777 *Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 00:14 To: ActiveDir@mail.activedir.org Subject: [ActiveDir] remove orphan DC from the domain Hi, We already had 3 Dcs in out network. Suddenly one Dc gone down permanently. That wont come live back. Right now we want to remove that orphan dc completely. I have seen Microsoft article 1. Click Start, point to Programs, point to Accessories, and then click Command Prompt. 2. At the command prompt, type ntdsutil, and then press ENTER. 3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur. 4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do this, type set creds DomainNameUserNamePassword, and then press ENTER. For a null password, type null for the password parameter. 5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server. Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message: Error 2094. The DSA Object cannot be deleted0x2094 6. Type quit, and then press ENTER. The Metadata Cleanup menu appears. 7. Type select operation target and press ENTER. 8. Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number. 9. Type select domain number and press ENTER, where number is the number associated with the domain the server you are removing is a member of. The domain you select is used to determine whether the server being removed is the last domain controller of that domain. 10. Type list sites and press ENTER. A list of sites, each with an associated number, appears. 11. Type s
RE: [ActiveDir] remove orphan DC from the domain
I forgot to mention: * If the DC that died had FSMO roles, you need to seize them (check which DC had FSMO roles with --> NETDOM QUERY FSMO) * DNS records are NOT removed by the NTDSUTIL. Must be done manually or wait if you have aging/scavenging enabled Also make sure the GC role and DNS roles is hosted by other computers (other DCs) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) ( Tel : +31-(0)40-29.57.777 ( Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 01:00 To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain Thanks for your logic. I hope so in the remaining Dc it will do automatically. Regards, Senthil From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Almeida Pinto, Jorge de Sent: Friday, January 26, 2007 5:10 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain the AD metadata cleanup is nothing more then removal/deletion of objects that belong to a DC that is not live anymore. Just other like other object deletions (user, group, etc) the deletions will replicate to other DCs (assuming replication is working fine) that host the same partitions from which the objects were removed. Because of that you only need to target ONE live DC in the same domain when using NTDSUTIL. Imagine a domain with a 1000 DCs It would be a PITA to cleanup the AD metadata of one of the DCs on the other 999 DCs... ;-)) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) * Tel : +31-(0)40-29.57.777 *Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 00:14 To: ActiveDir@mail.activedir.org Subject: [ActiveDir] remove orphan DC from the domain Hi, We already had 3 Dcs in out network. Suddenly one Dc gone down permanently. That wont come live back. Right now we want to remove that orphan dc completely. I have seen Microsoft article 1. Click Start, point to Programs, point to Accessories, and then click Command Prompt. 2. At the command prompt, type ntdsutil, and then press ENTER. 3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur. 4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do this, type set creds DomainNameUserNamePassword, and then press ENTER. For a null password, type null for the password parameter. 5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server. Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message: Error 2094. The DSA Object cannot be deleted0x2094 6. Type quit, and then press ENTER. The Metadata Cleanup menu appears. 7. Type select operation target and press ENTER. 8. Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number. 9. Type select domain number and press ENTER, where number is the number associated with the domain the server you are removing is a member of. The domain you select is used to determine whether the server being removed is the last domain controller of that domain. 10. Type list sites and press ENTER. A list of sites, each with an associated number, appears. 11. Type select site number and press ENTER, where number is the number associated with the site the server you are removing is a member of. You should receive a confirmation listing the site and domain you chose. 12. Type list servers in site and press ENTER. A list of servers in the site, each with an associated number, is displayed. 13. Type select server number, where number is the number associated with the server you want to remove. You receive a confirmation listing the selected server, its Domain Name System (DNS) host name, and the location of
RE: [ActiveDir] remove orphan DC from the domain
Thanks for your logic. I hope so in the remaining Dc it will do automatically. Regards, Senthil _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Almeida Pinto, Jorge de Sent: Friday, January 26, 2007 5:10 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] remove orphan DC from the domain the AD metadata cleanup is nothing more then removal/deletion of objects that belong to a DC that is not live anymore. Just other like other object deletions (user, group, etc) the deletions will replicate to other DCs (assuming replication is working fine) that host the same partitions from which the objects were removed. Because of that you only need to target ONE live DC in the same domain when using NTDSUTIL. Imagine a domain with a 1000 DCs It would be a PITA to cleanup the AD metadata of one of the DCs on the other 999 DCs... ;-)) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) * Tel : +31-(0)40-29.57.777 *Mobile : +31-(0)6-26.26.62.80 * E-mail : _ From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 00:14 To: ActiveDir@mail.activedir.org Subject: [ActiveDir] remove orphan DC from the domain Hi, We already had 3 Dcs in out network. Suddenly one Dc gone down permanently. That wont come live back. Right now we want to remove that orphan dc completely. I have seen Microsoft article 1. Click Start, point to Programs, point to Accessories, and then click Command Prompt. 2. At the command prompt, type ntdsutil, and then press ENTER. 3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur. 4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do this, type set creds DomainNameUserNamePassword, and then press ENTER. For a null password, type null for the password parameter. 5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server. Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message: Error 2094. The DSA Object cannot be deleted0x2094 6. Type quit, and then press ENTER. The Metadata Cleanup menu appears. 7. Type select operation target and press ENTER. 8. Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number. 9. Type select domain number and press ENTER, where number is the number associated with the domain the server you are removing is a member of. The domain you select is used to determine whether the server being removed is the last domain controller of that domain. 10. Type list sites and press ENTER. A list of sites, each with an associated number, appears. 11. Type select site number and press ENTER, where number is the number associated with the site the server you are removing is a member of. You should receive a confirmation listing the site and domain you chose. 12. Type list servers in site and press ENTER. A list of servers in the site, each with an associated number, is displayed. 13. Type select server number, where number is the number associated with the server you want to remove. You receive a confirmation listing the selected server, its Domain Name System (DNS) host name, and the location of the server's computer account you want to remove. 14. Type quit and press ENTER. The Metadata Cleanup menu appears. 15. Type remove selected server and press ENTER. You should receive confirmation that the removal completed successfully. If you receive the following error message, the NTDS Settings object may already be removed from Active Directory as the result of another administrator removing the NTDS Settings object or replication of the successful removal of the object after running the DCPROMO utility. Error 8419 (0x20E3) The DSA object could not be found Note You may also see this error when you try to bind to the domain controller that will be removed. Ntdsutil has to bind to a domain controller other than the one that will be removed with metadata cleanup. 16. Type quit, and then press ENTER at each menu quit the Ntdsutil utility. You should re
RE: [ActiveDir] remove orphan DC from the domain
the AD metadata cleanup is nothing more then removal/deletion of objects that belong to a DC that is not live anymore. Just other like other object deletions (user, group, etc) the deletions will replicate to other DCs (assuming replication is working fine) that host the same partitions from which the objects were removed. Because of that you only need to target ONE live DC in the same domain when using NTDSUTIL. Imagine a domain with a 1000 DCs It would be a PITA to cleanup the AD metadata of one of the DCs on the other 999 DCs... ;-)) Met vriendelijke groeten / Kind regards, Ing. Jorge de Almeida Pinto Senior Infrastructure Consultant MVP Windows Server - Directory Services LogicaCMG Nederland B.V. (BU RTINC Eindhoven) ( Tel : +31-(0)40-29.57.777 ( Mobile : +31-(0)6-26.26.62.80 * E-mail : From: [EMAIL PROTECTED] on behalf of senthil Kumar Sent: Fri 2007-01-26 00:14 To: ActiveDir@mail.activedir.org Subject: [ActiveDir] remove orphan DC from the domain Hi, We already had 3 Dcs in out network. Suddenly one Dc gone down permanently. That wont come live back. Right now we want to remove that orphan dc completely. I have seen Microsoft article 1. Click Start, point to Programs, point to Accessories, and then click Command Prompt. 2. At the command prompt, type ntdsutil, and then press ENTER. 3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur. 4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do this, type set creds DomainNameUserNamePassword, and then press ENTER. For a null password, type null for the password parameter. 5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server. Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message: Error 2094. The DSA Object cannot be deleted0x2094 6. Type quit, and then press ENTER. The Metadata Cleanup menu appears. 7. Type select operation target and press ENTER. 8. Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number. 9. Type select domain number and press ENTER, where number is the number associated with the domain the server you are removing is a member of. The domain you select is used to determine whether the server being removed is the last domain controller of that domain. 10. Type list sites and press ENTER. A list of sites, each with an associated number, appears. 11. Type select site number and press ENTER, where number is the number associated with the site the server you are removing is a member of. You should receive a confirmation listing the site and domain you chose. 12. Type list servers in site and press ENTER. A list of servers in the site, each with an associated number, is displayed. 13. Type select server number, where number is the number associated with the server you want to remove. You receive a confirmation listing the selected server, its Domain Name System (DNS) host name, and the location of the server's computer account you want to remove. 14. Type quit and press ENTER. The Metadata Cleanup menu appears. 15. Type remove selected server and press ENTER. You should receive confirmation that the removal completed successfully. If you receive the following error message, the NTDS Settings object may already be removed from Active Directory as the result of another administrator removing the NTDS Settings object or replication of the successful removal of the object after running the DCPROMO utility. Error 8419 (0x20E3) The DSA object could not be found Note You may also see this error when you try to bind to the domain controller that will be removed. Ntdsutil has to bind to a domain controller other than the one that will be removed with metadata cleanup. 16. Type quit, and then press ENTER at each menu quit the Ntdsutil utility. You should receive confirmation that the connection disconnected successfully. 17. Remove the cname record in the _msdcs.root domain of forest zone in DNS. Assuming that DC will be reinstalled and re-promoted, a new NTDS Settings object is created with a new GUID and a matching cname record in DNS. You do not want the DCs that exist to use the o
Re: [ActiveDir] remove orphan DC from the domain
It should be removed. We have the same situation on our site in the past and used the same article. We did a search on the AD later and found the odd piece of data hanging around in AD which we tidied up. Which domain controllers held which FSMO roles? Were any on the DC that you have lost? Have you managed to transfer these to another DC? Cheers, Matt Duguid Microsoft Systems Engineer Information and Technology Group - Identity Services The Department of Internal Affairs Te Tari Taiwhenua Direct Dial: +64 4 4748028 x8028 Fax: +64 4 4748894 Mobile: +64 21 1713290 Address: Level 4, 47 Boulcott Street, Wellington, New Zealand Internet: http://www.dia.govt.nz/ |-+--> | | | | | | | | | | | "senthil Kumar"| | | <[EMAIL PROTECTED]| | | com> | | | Sent by: | | | [EMAIL PROTECTED]| | | tivedir.org| | | | | | | | | 26/01/2007 12:14 p.m. | | | Please respond to | | | ActiveDir | | | | |-+--> >--| | | |To: | |cc: | |Subject: [ActiveDir] remove orphan DC from the domain | >--| Hi, We already had 3 Dcs in out network. Suddenly one Dc gone down permanently. That wont come live back. Right now we want to remove that orphan dc completely. I have seen Microsoft article 1. Click Start, point to Programs, point to Accessories, and then click Command Prompt. 2. At the command prompt, type ntdsutil, and then press ENTER. 3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur. 4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do this, type set creds DomainNameUserNamePassword, and then press ENTER. For a null password, type null for the password parameter. 5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server. Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message: Error 2094. The DSA Object cannot be deleted0x2094
