Windows AD Fix & Fine Tune Project

Last week I was assigned to a Windows AD fix & fine tune project. Basically this project is divided into 2 phases, where after I fix their current AD environment(WIndows Server 2000), I will implement 2 new domain controllers which is running Windows Server 2003 R2.

On the first day of the project,I found out that it has a total of 5 DCs in their current environment where 2 are production DCs, the rest are all failed DCs that did not decommissioned properly.

Immediately I know this is the root cause of the problem. Since the 3 failed DCs were shut down for quite some time, I proceed to remove and decommission them by using NTDSUTIL command.

Once the 3 failed DCs has been removed, the result shows that there is no more problem by running REPADMIN /SHOWREPL ,DCDIAG and NETDIAG.

Upon completion of phase 1, I proceed to implement 2 new DCs, transfer FSMO roles to the 2 new DCs as well as configured them as Global Catalog server.

Lastly I demote the 2 Windiws 2000 DCs by running DCPROMO, and the servers are demoted with gracefully without any problems.

Delete Failed DCs from Active Directory

My customer's AD environment ran into problems few days ago. Currently they have 4 production domain controllers, but they booted up an old domain controller which has been down for more than 2 months and causing the client to face slow login issue.

Immediately they shutdown the problematic DC and requested us to decommission the failed DC for them.

By right, running "dcpromo" on the failed DC to decommission it is the fastest and easiest way to achieve the goal, but somehow dcpromo doesn't work as expected, so I use the command "ntdsutil" to accomplish my mission.

"ntdsuitl" is a very useful and powerful command, click here to read more about it about how to use "ntdsutil" to decommission a failed DC.