The problem comes if you want to demote the existing DC and re-promote it with the same name and IP address on a different physical computer. When you re-promote the DC or want to promote another machine with the same name and IP address, it will create a new computer account with a new GUID. If you do the new promotion before the first object deletion has replicated to all DCs in the forest, it will cause a great deal of confusion about the status of this object. Some domain controllers will know that the old object is deleted and the new one is now in existence. Some will see the old one but not the new one, and some will see both as valid objects.
The tricky part of this operation is to determine when all the DCs have replicated the deletion. Usually you can just wait overnight to be sure, but there is an easy way to find out using the Repadmin command. Repadmin.exe is part of the Windows Support tools for Windows 2003 Service Pack 1. These support tools are not installed automatically by installing SP1. If you have a CD for SP1, they will be on the CD. Or you can download them. Also refer to KB 892777. If you have a Windows 2000 environment, then you can install the support tools on a Windows 2003 Server or XP workstation and execute the command.
The general command using the /ShowObjMeta is:
Repadmin /showObjMeta <DC name > < "DN of computer object">
In the following example, the DC HPQNET-DC3 has been demoted and removed. It's Distinguished Name, or DN, is DC=hpqnet-DC3,DC=hpqnet,DC-cpqcorp, DC=net.
C:\>repadmin /showobjmeta hpqnet-dc3 "CN=HPQnet-DC3,OU=Domain Controllers OU, DC=hpqnet,DC=qtest,DC=cpqcorp,DC=net"
Executing the Repadmin command above returned the following table:
This command dumps the values of all object attributes if it finds the object. If it doesn't find the object, it will return an error:
DsReplicaGetInfo() failed with status 8333 (0x208d): Directory object not found.
There is one final option that will allow admins to execute this command on all DCs with one command -- without having to execute it on each DC individually. Using the * in the DCLIST option executes the command on all DCs – one at a time – and reports if it finds the object. If it returns an error, then the computer object is not in the DC OU because that was the path we are searching for. When all DCs report the error, then we know all of them have moved the old DC computer object into the Deleted Objects folder and it is safe to promote the new computer using the name and IP of the old one.
The command in our example to execute on all DCs would be
C:\>repadmin /showobjmeta *"cn=hpqbox-dc03,ou=domain controllers,dc=hpqbox,dc=a dapps,dc=hp,dc=com" >objmeta.txt
Here, we have redirected the output to a text file, Objmeta.txt.
Again, if any of the DCs in the report return attributes for the object, then the deletion has not replicated there yet. If there is an error for each DC in the list, then AD object replication has completed and the new machine can be promoted.
Gary Olsen is a systems software engineer for Hewlett-Packard in Global Solutions Engineering. He wrote Windows 2000: Active Directory Design and Deployment and co-authored Windows Server 2003 on HP ProLiant Servers. Olsen is a Microsoft MVP for Directory Services and formerly for Windows File Systems.. This was first published in April 2008
This was first published in April 2008