ADSIEdit problem - can't delete domain DC

[Jimmy Andersson [MVP]]

Have you tried to delete it with Ldp?

Regards,
/Jimmy

 

[kwele]

Successfully demoted Windows 2000 DC. However, its data still remained
in AD.

Following KB216498, I removed its data using ntdsutil. I attempted to
delete the computer account using ADSIEdit. When I tried to delete the
domain controller, it said 'Access denied'. I then changed the value
of UserAccountControl to 4096 and tried to delete again. However, I
received the same 'Access denied' message.

Any ideas? I'd really like to get rid of this DC.

Thanks, kwele

 

[kwele]

Jimmy,

No, I hadn't, but when I tried to delete, I got the following message:

ldap_delete_s(ld, "CN=DCName,OU=Domain Controllers,DC=domain,DC=com");
Error: Delete: Not allowed on Non-leaf. <66>

I'm assuming this happened because it has 6 child containers (3
printer objects plus IASIdentity, NTFRS, RouterIdentity objects).
Should I delete these first and then the parent container?

Sorry for the ignorant questions, but this is the first time for me in
this area.

Thanks, kwele

 

[Nathan]

I'm assuming this happened because it has 6 child
containers

I'm most alarmed by this statement. You should move those
OU's before trying to remove anything below. The printers
are "members", and should not be as big a problem.

 

[kwele]

Nathan,

I did delete those OUs before reading your response. When I view the
remaining 2 DCs, both of which are Windows 2003, they have the NTFRS
subscriptions as did the demoted Windows 2000 DC.

However, the IASIdentity and RouterIdentity objects do not appear. Is
it possible or necessary to add them? When I run dcdiag now,
everything seems to be OK.

kwele

 

[Nathan]

I did delete those OUs before reading your response. When

Glad you got past your first obstacle. Re-post in a NEW
topic the question about IASIdentity, FourterIdentity and
NTFRS. I'm learning a lot about AD right now, but I don't
even want to start touching that part of your questions.

Good Luck,

Nathan