Urgent; Demote W2k DC

G

Guest

Dears;

when I start to demote a w2k DC it show me the following msg.

"The operation failed because: The attempt to configure the machine account
MADINEH02$ on server MADINEH01.MADINEH.aleppo.BBSF.com failed. "Access is
denied. "

Specify an account with Enterprise Administrator privileges to the forest,
"BBSF.com"
 
M

Myweb

Hello Mhd,

So whats the problem, the solution stands in the text, be an Enterprise admin.

Best regards

Myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
 
G

Guest

Dear;

I am using an enterprise admin. user

Myweb said:
Hello Mhd,

So whats the problem, the solution stands in the text, be an Enterprise admin.

Best regards

Myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
 
A

Andrei Ungureanu

you can use the dcpromo /forceremoval option and then do a metadata cleanup.
 
G

Guest

Hi MHD,

I hate it when stuff like that happens. This is usually the result of some
kind of problem with the DNS or the replication topology. To make your way
through this you'll want to attack the problem through three phases before
jumping right into it. It might take a little bit longer, but it will give
you a better solution and will act as a good pattern for future problems.

1. Triage the issue
Look at the logs and run DCDIAG and NETDIAG against the Domain Controllers
that are working in your environment. This will often point you at the issue
that caused the problem. Resolve the DNS and replication problems in the
domain at this point. This will also let you see where there are references
to the DC that you tried to add.

2. Deal with the misbehaving DC
You can try a regular DCPROMO at this point. If you ahve taken care fo the
DNS problems, it will oftentimes com out at this point. If it doesn't you do
have the option to use the /forceremove switch. Just know that you'll have
to do the metadata cleanup process, manually go through your SRV records in
your DNS and may have to pull records out of sites and services. Make sure
that the changes have replicated to all sites before you put this back in,
otherwise you might run into conflicts later.

3. Join the DC again
Get the DC into the domain as a member server. At this point you will want
to make sure that you can ping the other DCs, especially the one with the
PDCe role assigned to it. You should also ping the domain name (FQDN
format). This should return the IP address of the PDCe as well. If it
doesn't, you are headed for the same problem and will ahve to go back to
troubleshooting your DNS as well as your site/ subnet definitions. Finally,
since you had issues with the domain, you might want to go through the DCDIAG
and REPLMON reports again before adding the DC, just to be sure that there
are no other domain health issues creaping in.

Best wishes!
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Top