Hi Folks;

I recently ran dcpromo on this machine and removed AD and DNS. Thing is, I
still have these entries in the event viewer;

DNS Server
Directory Service
File Replication Service

I can't seem to figure out where in the registry a person can get rid of
these things or if there's another trick to it.

Can anyone help with this?

Marvin Miller wrote:
> Hi Folks;
>
> I recently ran dcpromo on this machine and removed AD and DNS. Thing
> is, I still have these entries in the event viewer;
>
> DNS Server
> Directory Service
> File Replication Service
>
> I can't seem to figure out where in the registry a person can get rid
> of these things or if there's another trick to it.
>
> Can anyone help with this?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
Delete the subkeys for the logs you want to delete.

--
Best regards,
Kevin D. Goodknecht Sr. [MVP]
Hope This Helps
===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
http://support.wftx.us/
https://secure.lsaol.com/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
===================================

"Kevin D. Goodknecht Sr. [MVP]" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Marvin Miller wrote:
> > Hi Folks;
> >
> > I recently ran dcpromo on this machine and removed AD and DNS. Thing
> > is, I still have these entries in the event viewer;
> >
> > DNS Server
> > Directory Service
> > File Replication Service
> >
> > I can't seem to figure out where in the registry a person can get rid
> > of these things or if there's another trick to it.
> >
> > Can anyone help with this?
>
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
> Delete the subkeys for the logs you want to delete.
>
> --
> Best regards,
> Kevin D. Goodknecht Sr. [MVP]
> Hope This Helps
> ===================================
> When responding to posts, please "Reply to Group"
> via your newsreader so that others may learn and
> benefit from your issue, to respond directly to
> me remove the nospam. from my email address.
> ===================================
> http://www.lonestaramerica.com/
> http://support.wftx.us/
> https://secure.lsaol.com/
> ===================================
> Use Outlook Express?... Get OE_Quotefix:
> It will strip signature out and more
> http://home.in.tum.de/~jain/software/oe-quotefix/
> ===================================
> Keep a back up of your OE settings and folders
> with OEBackup:
> http://www.oehelp.com/OEBackup/Default.aspx
> ===================================
>
>
Hi Kevin - thanks for the reply :-)

I tried that but what happens is that when I open up event viewer after
deleting the appropriate subkeys I still get them listed there but now they
have a dred circle with an X through them. So they are not really gone fom
the display.

I wonder what the scoop is?

In news:(E-Mail Removed),
Marvin Miller <(E-Mail Removed)> stated, which I commented on below:
>
> Hi Kevin - thanks for the reply :-)
>
> I tried that but what happens is that when I open up event viewer
> after deleting the appropriate subkeys I still get them listed there
> but now they have a dred circle with an X through them. So they are
> not really gone fom the display.
>
> I wonder what the scoop is?

Do you see a dnsevent.evt file in the System32\Config folder?

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.

It's easy:
How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Infinite Diversities in Infinite Combinations
Assimilation Imminent. Resistance is Futile
"Very funny Scotty. Now, beam down my clothes."

The only thing in life is change. Anything more is a blackhole consuming
unnecessary energy. - [Me]

Hi Ace;

I sure do! I also see one for the file replication service that's also still
stuck in the event viewer after removing Active Directory :-)

What's that mean? Do I need to delete them as well as the registry keys?

Thank You!
Marvin


"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:%23%(E-Mail Removed)...
> In news:(E-Mail Removed),
> Marvin Miller <(E-Mail Removed)> stated, which I commented on below:
> >
> > Hi Kevin - thanks for the reply :-)
> >
> > I tried that but what happens is that when I open up event viewer
> > after deleting the appropriate subkeys I still get them listed there
> > but now they have a dred circle with an X through them. So they are
> > not really gone fom the display.
> >
> > I wonder what the scoop is?
>
> Do you see a dnsevent.evt file in the System32\Config folder?
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Having difficulty reading or finding responses to your post?
> Instead of the website you're using, I suggest to use OEx (Outlook Express
> or any other newsreader), and configure a news account, pointing to
> news.microsoft.com. This is a direct link to the Microsoft Public
> Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows
you
> to easily find, track threads, cross-post, sort by date, poster's name,
> watched threads or subject.
>
> It's easy:
> How to Configure OEx for Internet News
> http://support.microsoft.com/?id=171164
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
> Microsoft MVP - Directory Services
> Microsoft Certified Trainer
>
> Infinite Diversities in Infinite Combinations
> Assimilation Imminent. Resistance is Futile
> "Very funny Scotty. Now, beam down my clothes."
>
> The only thing in life is change. Anything more is a blackhole consuming
> unnecessary energy. - [Me]
>
>

In news:(E-Mail Removed),
Marvin Miller <(E-Mail Removed)> stated, which I commented on below:
> Hi Ace;
>
> I sure do! I also see one for the file replication service that's
> also still stuck in the event viewer after removing Active Directory
> :-)
>
> What's that mean? Do I need to delete them as well as the registry
> keys?
>
> Thank You!
> Marvin

You could delete them, but for best practice, rename them something like
..old and see what happens.

Ace

Hi Ace;

Same deal :-(

I started up Event Viewer and right clicked on the DNS category and chose
delete. I then renamed the files in teh registry .old and then deleted off
the registry entries - same thing. They are still listed in the left window
of Event Viewer but with a circle and a red X through them.

This is wierd. The computer was a DC and DCPROMO was run on it and Active
Directory was removed. The procedure worked well except for the Event
Viewer.

Best;
Marvin

"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:%23V%(E-Mail Removed)...
> In news:(E-Mail Removed),
> Marvin Miller <(E-Mail Removed)> stated, which I commented on below:
> > Hi Ace;
> >
> > I sure do! I also see one for the file replication service that's
> > also still stuck in the event viewer after removing Active Directory
> > :-)
> >
> > What's that mean? Do I need to delete them as well as the registry
> > keys?
> >
> > Thank You!
> > Marvin
>
> You could delete them, but for best practice, rename them something like
> .old and see what happens.
>
> Ace
>
>

Marvin Miller wrote:
> Hi Ace;
>
> Same deal :-(
>
> I started up Event Viewer and right clicked on the DNS category and
> chose delete. I then renamed the files in teh registry .old and then
> deleted off the registry entries - same thing. They are still listed
> in the left window of Event Viewer but with a circle and a red X
> through them.
>
> This is wierd. The computer was a DC and DCPROMO was run on it and
> Active Directory was removed. The procedure worked well except for
> the Event Viewer.

Did you actually uninstall the DNS service in Add/remove Programs?
If you didn't DNS is still installed and it needs the event log.

--
Best regards,
Kevin D. Goodknecht Sr. [MVP]
Hope This Helps
===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
http://support.wftx.us/
https://secure.lsaol.com/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
===================================

"Kevin D. Goodknecht Sr. [MVP]" <(E-Mail Removed)> wrote in message
news:eyr$(E-Mail Removed)...
> Marvin Miller wrote:
> > Hi Ace;
> >
> > Same deal :-(
> >
> > I started up Event Viewer and right clicked on the DNS category and
> > chose delete. I then renamed the files in teh registry .old and then
> > deleted off the registry entries - same thing. They are still listed
> > in the left window of Event Viewer but with a circle and a red X
> > through them.
> >
> > This is wierd. The computer was a DC and DCPROMO was run on it and
> > Active Directory was removed. The procedure worked well except for
> > the Event Viewer.
>
> Did you actually uninstall the DNS service in Add/remove Programs?
> If you didn't DNS is still installed and it needs the event log.
>
> --
> Best regards,
> Kevin D.

Hi Kevin;

I just checked and DNS is not installed. That gave me an idea though - I
re-installed and then un-installed it - but it's still there in the Event
Viewer along with Directory Service and File Replication Service.

I don't understand - running DCPROMO went well and the machine was demoted
back to a server but I guess it left pieces of itself behind.

Any other ideas on how to remove these puppies?

Thanks!
Marvin

In news:(E-Mail Removed),
Marvin Miller <(E-Mail Removed)> stated, which I commented on below:

> Hi Kevin;
>
> I just checked and DNS is not installed. That gave me an idea though
> - I re-installed and then un-installed it - but it's still there in
> the Event Viewer along with Directory Service and File Replication
> Service.
>
> I don't understand - running DCPROMO went well and the machine was
> demoted back to a server but I guess it left pieces of itself behind.
>
> Any other ideas on how to remove these puppies?
>
> Thanks!
> Marvin

Dumb assumption on my part: I'm assuming you are selecting the correct spot
in the reg to do this, (such as CurrentControlSet, and not
CurrentControlSet001), etc ?

Ace