Really ?
That is a very interesting... Could you develop this statement please ?
What is a XFER ?
When you say "it does a seize", that means it choose a DC nearby ? and
seize *automatically* a seizure ?
Thanks,
Yann
*/Paul Williams <[EMAIL PROTECTED]>/* a écrit :
> If the DC that died had FSMO roles, you need to seize them
(check which
> DC had FSMO roles with --> NETDOM QUERY FSMO)
This step is no longer necessary in k3 SP1. NTDSUTIL does it for
you. If I
remember correctly, it tries a XFER and then does a Seize (as
that's the
logic for the Seize anyway).
I believe this was added in SP1.
--Paul
----- Original Message -----
From: "Almeida Pinto, Jorge de"
To:
Sent: Friday, January 26, 2007 7:05 AM
Subject: RE: [ActiveDir] remove orphan DC from the domain
I forgot to mention:
* If the DC that died had FSMO roles, you need to seize them
(check which DC
had FSMO roles with --> NETDOM QUERY FSMO)
* DNS records are NOT removed by the NTDSUTIL. Must be done
manually or wait
if you have aging/scavenging enabled
Also make sure the GC role and DNS roles is hosted by other
computers (other
DCs)
Met vriendelijke groeten / Kind regards,
Ing. Jorge de Almeida Pinto
Senior Infrastructure Consultant
MVP Windows Server - Directory Services
LogicaCMG Nederland B.V. (BU RTINC Eindhoven)
( Tel : +31-(0)40-29.57.777
( Mobile : +31-(0)6-26.26.62.80
* E-mail :
________________________________
From: [EMAIL PROTECTED] on behalf of senthil Kumar
Sent: Fri 2007-01-26 01:00
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] remove orphan DC from the domain
Thanks for your logic. I hope so in the remaining Dc it will do
automatically.
Regards,
Senthil
________________________________
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Almeida
Pinto,
Jorge de
Sent: Friday, January 26, 2007 5:10 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] remove orphan DC from the domain
the AD metadata cleanup is nothing more then removal/deletion of
objects
that belong to a DC that is not live anymore. Just other like
other object
deletions (user, group, etc) the deletions will replicate to other
DCs
(assuming replication is working fine) that host the same
partitions from
which the objects were removed. Because of that you only need to
target ONE
live DC in the same domain when using NTDSUTIL.
Imagine a domain with a 1000 DCs.... It would be a PITA to cleanup
the AD
metadata of one of the DCs on the other 999 DCs... ;-))
Met vriendelijke groeten / Kind regards,
Ing. Jorge de Almeida Pinto
Senior Infrastructure Consultant
MVP Windows Server - Directory Services
LogicaCMG Nederland B.V. (BU RTINC Eindhoven)
* Tel : +31-(0)40-29.57.777
* Mobile : +31-(0)6-26.26.62.80
* E-mail :
________________________________
From: [EMAIL PROTECTED] on behalf of senthil Kumar
Sent: Fri 2007-01-26 00:14
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] remove orphan DC from the domain
Hi,
We already had 3 Dcs in out network. Suddenly one Dc gone down
permanently.
That wont come live back. Right now we want to remove that orphan dc
completely. I have seen Microsoft article
1.
Click Start, point to Programs, point to Accessories, and then
click Command
Prompt.
2.
At the command prompt, type ntdsutil, and then press ENTER.
3.
Type metadata cleanup, and then press ENTER. Based on the options
given, the
administrator can perform the removal, but additional configuration
parameters must be specified before the removal can occur.
4.
Type connections and press ENTER. This menu is used to connect to the
specific server where the changes occur. If the currently logged
on user
does not have administrative permissions, different credentials
can be
supplied by specifying the credentials to use before making the
connection.
To do this, type set creds DomainNameUserNamePassword, and then
press ENTER.
For a null password, type null for the password parameter.
5.
Type connect to server servername, and then press ENTER. You
should receive
confirmation that the connection is successfully established. If
an error
occurs, verify that the domain controller being used in the
connection is
available and the credentials you supplied have administrative
permissions
on the server.
Note If you try to connect to the same server that you want to
delete, when
you try to delete the server that step 15 refers to, you may
receive the
following error message:
Error 2094. The DSA Object cannot be deleted0x2094
6.
Type quit, and then press ENTER. The Metadata Cleanup menu appears.
7.
Type select operation target and press ENTER.
8.
Type list domains and press ENTER. A list of domains in the forest is
displayed, each with an associated number.
9.
Type select domain number and press ENTER, where number is the number
associated with the domain the server you are removing is a member
of. The
domain you select is used to determine whether the server being
removed is
the last domain controller of that domain.
10.
Type list sites and press ENTER. A list of sites, each with an
associated
number, appears.
11.
Type select site number and press ENTER, where number is the number
associated with the site the server you are removing is a member
of. You
should receive a confirmation listing the site and domain you chose.
12.
Type list servers in site and press ENTER. A list of servers in
the site,
each with an associated number, is displayed.
13.
Type select server number, where number is the number associated
with the
server you want to remove. You receive a confirmation listing the
selected
server, its Domain Name System (DNS) host name, and the location
of the
server's computer account you want to remove.
14.
Type quit and press ENTER. The Metadata Cleanup menu appears.
15.
Type remove selected server and press ENTER. You should receive
confirmation
that the removal completed successfully. If you receive the
following error
message, the NTDS Settings object may already be removed from Active
Directory as the result of another administrator removing the NTDS
Settings
object or replication of the successful removal of the object
after running
the DCPROMO utility.
Error 8419 (0x20E3)
The DSA object could not be found
Note You may also see this error when you try to bind to the domain
controller that will be removed. Ntdsutil has to bind to a domain
controller
other than the one that will be removed with metadata cleanup.
16.
Type quit, and then press ENTER at each menu quit the Ntdsutil
utility. You
should receive confirmation that the connection disconnected
successfully.
17.
Remove the cname record in the _msdcs.root domain of forest zone
in DNS.
Assuming that DC will be reinstalled and re-promoted, a new NTDS
Settings
object is created with a new GUID and a matching cname record in
DNS. You do
not want the DCs that exist to use the old cname record.
As best practice, you should delete the host name and other DNS
records. If
the lease time that remains on Dynamic Host Configuration Protocol
(DHCP)
address assigned to offline server is exceeded then another client
can
obtain the IP address of the problem DC.
18.
In the DNS console, use the DNS MMC to delete the A record in DNS.
The A
record is also known as the Host record. To delete the A record,
right-click
the A record, and then click Delete. Also, delete the cname record
in the
_msdcs container. To do this, expand the _msdcs container,
right-click
cname, and then click Delete.
Important If this is a DNS server, remove the reference to this DC
under the
Name Servers tab. To do this, in the DNS console, click the domain
name
under Forward Lookup Zones, and then remove this server from the Name
Servers tab.
Note If you have reverse lookup zones, also remove the server from
these
zones.
19.
If the deleted computer is the last domain controller in a child
domain, and
the child domain was also deleted, use ADSIEdit to delete the
trustDomain
object for the child. To do this, follow these steps:
a.
Click Start, click Run, type adsiedit.msc, and then click OK
b.
Expand the Domain NC container.
c.
Expand DC=Your Domain, DC=COM, PRI, LOCAL, NET.
d.
Expand CN=System.
e.
Right-click the Trust Domain object, and then click Delete.
20.
Use Active Directory Sites and Services to remove the domain
controller. To
do this, follow these steps:
a.
Start Active Directory Sites and Services.
b.
Expand Sites.
c.
Expand the server's site. The default site is
Default-First-Site-Name.
d.
Expand Server.
e.
Right-click the domain controller, and then click Delete.
I have connected to one of my live Dc using ntds util and deleted
the orphan
Dc. It shows the message that orphan dc was removed from the
current dc.
Is it completely removed or should I need to do the same process
on the
other also.
Regards,
Senthil
This e-mail and any attachment is for authorised use by the intended
recipient(s) only. It may contain proprietary material, confidential
information and/or be subject to legal privilege. It should not be
copied,
disclosed to, retained or used by, any other party. If you are not an
intended recipient then please promptly delete this e-mail and any
attachment and all copies and inform the sender. Thank you.
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.activedir.org/ma/default.aspx
------------------------------------------------------------------------
Découvrez une nouvelle façon d'obtenir des réponses à toutes vos
questions ! Profitez des connaissances, des opinions et des expériences
des internautes sur Yahoo! Questions/Réponses
<http://fr.rd.yahoo.com/evt=42054/*http://fr.answers.yahoo.com>.
