PDC or member server

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Strange situation- I added a MEMBER server to my domain to check out a
Terminal server setup. When I finished, I wanted to remove it from the
domain. On the master server, I found this member server listed under domain
controllers but it was not set up as one. I could not delete it from this
location- received a message- DSA object cannot be deleted. Another strange
thing, the master server is no longer listed under domain controllers! I had
also added a second domain controller set up with win 2003 server. This
server is listed in the PDC domain controllers listings. Needless to say, I
receved a variety of error messages in the event listings Help!!
--
Dutch
3 answers Last reply
More about member server
  1. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    Hi Dutch,

    According to your description, I would like to confirm that have you ever
    promote this member to be a DC and encounter the failure?

    The error you have encountered is a common scenario if you have run
    "dcpromo" on the member server, however, the server has not been
    successfully promoted and the active directory has not been installed.
    Therefore, this machine is still a member server in the network. However,
    dcpromo process has written some information in DC's active directory
    database, which is the reason you see the member server name under DC and
    cannot delete it. I understand you are concerned about the master server
    not listed under DC, let us focus on the member server first.

    Please carefully read the following article to cleanup the metadata, pay
    attention to the paragraph " If you receive the "DSA object cannot be
    deleted" error message " to set the key:


    How to remove data in Active Directory after an unsuccessful domain
    controller demotion
    http://support.microsoft.com/default.aspx?scid=kb;en-us;216498

    HTH!

    Any update, let us get in touch!

    Best regards,

    Rebecca Chen

    MCSE2000 MCDBA CCNA


    Microsoft Online Partner Support
    Get Secure! - www.microsoft.com/security

    =====================================================

    When responding to posts, please "Reply to Group" via your newsreader so
    that others may learn and benefit from your issue.

    =====================================================
    This posting is provided "AS IS" with no warranties, and confers no rights.
  2. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    Rebecca, No this server was never promoted to a domain controller. I set it
    up just as a member server to try out terminal services
    --
    Dutch


    ""Rebecca Chen [MSFT]"" wrote:

    > Hi Dutch,
    >
    > According to your description, I would like to confirm that have you ever
    > promote this member to be a DC and encounter the failure?
    >
    > The error you have encountered is a common scenario if you have run
    > "dcpromo" on the member server, however, the server has not been
    > successfully promoted and the active directory has not been installed.
    > Therefore, this machine is still a member server in the network. However,
    > dcpromo process has written some information in DC's active directory
    > database, which is the reason you see the member server name under DC and
    > cannot delete it. I understand you are concerned about the master server
    > not listed under DC, let us focus on the member server first.
    >
    > Please carefully read the following article to cleanup the metadata, pay
    > attention to the paragraph " If you receive the "DSA object cannot be
    > deleted" error message " to set the key:
    >
    >
    > How to remove data in Active Directory after an unsuccessful domain
    > controller demotion
    > http://support.microsoft.com/default.aspx?scid=kb;en-us;216498
    >
    > HTH!
    >
    > Any update, let us get in touch!
    >
    > Best regards,
    >
    > Rebecca Chen
    >
    > MCSE2000 MCDBA CCNA
    >
    >
    > Microsoft Online Partner Support
    > Get Secure! - www.microsoft.com/security
    >
    > =====================================================
    >
    > When responding to posts, please "Reply to Group" via your newsreader so
    > that others may learn and benefit from your issue.
    >
    > =====================================================
    > This posting is provided "AS IS" with no warranties, and confers no rights.
    >
    >
  3. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    Hi Dutch,


    Thanks for the update!

    This issue seems a little strange since the memeber server information has
    been added as DC in the active directory database. A common scenario is
    that the member server has been promoted to DC, however, the promotion
    process has failed. I understand you only join the member server in the
    domain, now It is necessary to clean up the metedate as KB 216498 descrbied
    since the information is already in AD database. I would like to extract
    the main steps from KB216498 and please use the steps to clean up the data
    and set the registry:

    Step 1: Clean up metedata:
    ========================
    1. Click Start, point to Programs, point to Accessories, and then click
    Command Prompt.
    2. At the command prompt, type ntdsutil, and then press ENTER.
    3. Type metadata cleanup, and then press ENTER. Based on the options given,
    the administrator can perform the removal, but additional configuration
    parameters must be specified before the removal can occur.
    4. Type connections and press ENTER. This menu is used to connect to the
    specific server where the changes occur. If the currently logged on user
    does not have administrative permissions, different credentials can be
    supplied by specifying the credentials to use before making the connection.
    To do so, type set creds DomainNameUserNamePassword, and then press ENTER.
    For a null password, type null for the password parameter.
    5. Type connect to server servername, and then press ENTER. You should
    receive confirmation that the connection is successfully established. If an
    error occurs, verify that the domain controller being used in the
    connection is available and the credentials you supplied have
    administrative permissions on the server.

    Note If you try to connect to the same server that you want to delete, when
    you try to delete the server that step 15 refers to, you may receive the
    following error message:
    Error 2094. The DSA Object cannot be deleted0x2094
    6. Type quit, and then press ENTER. The Metadata Cleanup menu appears.
    7. Type select operation target and press ENTER.
    8. Type list domains and press ENTER. A list of domains in the forest is
    displayed, each with an associated number.
    9. Type select domain number and press ENTER, where number is the number
    associated with the domain the server you are removing is a member of. The
    domain you select is used to determine if the server being removed is the
    last domain controller of that domain.
    10. Type list sites and press ENTER. A list of sites, each with an
    associated number, is displayed.
    11. Type select site number and press ENTER, where number is the number
    associated with the site the server you are removing is a member of. You
    should receive a confirmation listing the site and domain you chose.
    12. Type list servers in site and press ENTER. A list of servers in the
    site, each with an associated number, is displayed.
    13. Type select server number, where number is the number associated with
    the server you want to remove. You receive a confirmation listing the
    selected server, its Domain Name Server (DNS) host name, and the location
    of the server's computer account you want to remove.
    14. Type quit and press ENTER. The Metadata Cleanup menu appears.
    15. Type remove selected server and press ENTER. You should receive
    confirmation that the removal completed successfully. If you receive the
    following error message:
    Error 8419 (0x20E3)
    The DSA object could not be found
    the NTDS Settings object may already be removed from Active Directory as
    the result of another administrator removing the NTDS Settings object, or
    replication of the successful removal of the object after running the
    DCPROMO utility.

    Note You may also see this error when you try to bind to the domain
    controller that is going to be removed. Ntdsutil has to bind to a domain
    controller other than the one that is going to be removed with metadata
    cleanup.
    16. Type quit at each menu to quit the Ntdsutil utility. You should receive
    confirmation that the connection disconnected successfully.
    17. Remove the cname record in the _msdcs.root domain of forest zone in
    DNS. Assuming that DC is going to be reinstalled and re-promoted, a new
    NTDS Settings object is created with a new GUID and a matching cname record
    in DNS. You do not want the DC's that exist to use the old cname record.

    As best practice you should delete the hostname and other DNS records. If
    the lease time that remains on Dynamic Host Configuration Protocol (DHCP)
    address assigned to offline server is exceeded then another client can
    obtain the IP address of the problem DC.

    Step 2: DSA cannot be deleted
    ==================================
    Use ADSIEdit to delete the computer account. To do this, follow these
    steps: a. Click Start, click Run, type adsiedit.msc in the Open box, and
    then click OK.
    b. Expand the Domain NC container.
    c. Expand DC=Your Domain Name, DC=COM, PRI, LOCAL, NET.
    d. Expand OU=Domain Controllers.
    e. Right-click CN=domain controller name, and then click Delete.
    If you receive the "DSA object cannot be deleted" error message when you
    try to delete the object, change the UserAccountControl value. To change
    the UserAccountControl value, right-click the domain controller in
    ADSIEdit, and then click Properties. Under Select a property to view, click
    UserAccountControl. Click Clear, change the value to 4096, and then click
    Set. You can now delete the object.

    I understand performing the steps above will be a tedious and
    time-consuming task. However, cleaning up the metedate will make sure the
    data is clean in AD database, it would be helpful if you want to promote an
    additional DC in the future.

    If you have any update or quesitons, please feel free to post back.



    --------------------
    >Thread-Topic: PDC or member server
    >thread-index: AcVsQQ1BhMxALtOyT+OWGrhnF6kP3g==
    >X-WBNR-Posting-Host: 164.58.1.130
    >From: "=?Utf-8?B?ZHV0Y2g=?=" <dutch@anon.postalias>
    >References: <89D2BE2F-671A-4ED8-964B-2E127A7D740B@microsoft.com>
    <wrsQcKxaFHA.3336@TK2MSFTNGXA01.phx.gbl>
    >Subject: RE: PDC or member server
    >Date: Wed, 8 Jun 2005 08:45:10 -0700
    >Lines: 54
    >Message-ID: <FB47CC99-5CE6-4C92-9A37-EB43CFA89398@microsoft.com>
    >MIME-Version: 1.0
    >Content-Type: text/plain;
    > charset="Utf-8"
    >Content-Transfer-Encoding: 7bit
    >X-Newsreader: Microsoft CDO for Windows 2000
    >Content-Class: urn:content-classes:message
    >Importance: normal
    >Priority: normal
    >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
    >Newsgroups: microsoft.public.win2000.active_directory
    >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
    >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
    >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.win2000.active_directory:30270
    >X-Tomcat-NG: microsoft.public.win2000.active_directory
    >
    >Rebecca, No this server was never promoted to a domain controller. I set
    it
    >up just as a member server to try out terminal services
    >--
    >Dutch
    >
    >
    >""Rebecca Chen [MSFT]"" wrote:
    >
    >> Hi Dutch,
    >>
    >> According to your description, I would like to confirm that have you
    ever
    >> promote this member to be a DC and encounter the failure?
    >>
    >> The error you have encountered is a common scenario if you have run
    >> "dcpromo" on the member server, however, the server has not been
    >> successfully promoted and the active directory has not been installed.
    >> Therefore, this machine is still a member server in the network.
    However,
    >> dcpromo process has written some information in DC's active directory
    >> database, which is the reason you see the member server name under DC
    and
    >> cannot delete it. I understand you are concerned about the master server
    >> not listed under DC, let us focus on the member server first.
    >>
    >> Please carefully read the following article to cleanup the metadata, pay
    >> attention to the paragraph " If you receive the "DSA object cannot be
    >> deleted" error message " to set the key:
    >>
    >>
    >> How to remove data in Active Directory after an unsuccessful domain
    >> controller demotion
    >> http://support.microsoft.com/default.aspx?scid=kb;en-us;216498
    >>
    >> HTH!
    >>
    >> Any update, let us get in touch!
    >>
    >> Best regards,
    >>
    >> Rebecca Chen
    >>
    >> MCSE2000 MCDBA CCNA
    >>
    >>
    >> Microsoft Online Partner Support
    >> Get Secure! - www.microsoft.com/security
    >>
    >> =====================================================
    >>
    >> When responding to posts, please "Reply to Group" via your newsreader so
    >> that others may learn and benefit from your issue.
    >>
    >> =====================================================
    >> This posting is provided "AS IS" with no warranties, and confers no
    rights.
    >>
    >>
    >

    Best regards,

    Rebecca Chen

    MCSE2000 MCDBA CCNA


    Microsoft Online Partner Support
    Get Secure! - www.microsoft.com/security

    =====================================================

    When responding to posts, please "Reply to Group" via your newsreader so
    that others may learn and benefit from your issue.

    =====================================================
    This posting is provided "AS IS" with no warranties, and confers no rights.
Ask a new question

Read More

Domain Servers Active Directory Windows