6

Today I had (again...) to lobotomize a domain controller which had suffered the dreaded USN rollback; the standard solution to this issue is to demote it and then promote it back again, but the main problem is, the demote isn't going to work, because the USN rollback condition prevents any replication from happening, thus not allowing the DC being demoted to perform its final replication and die gracefully. Usually, you end up shutting down the server, removing any reference to it from Active Directory, and then reinstalling Windows from scratch.

However, you might have other software or data on that server; or, you may just not want to completely rebuild it, if a demote could suffice.

So, my question is: how can I successfully demote a domain controller which has suffered a USN rollback?

What I tried:

I isolated the server from the network, launched the demote process and, when asked, told it it was the last DC in the domain; but it still complained about this not being true.

So I removed all other DCs from its copy of the Active Directory, and then did the same as above; but even this failed again, with an error about being unable to replicate a directory partition (to who? It was supposed to be the only DC around!).

Massimo
  • 70,200
  • 57
  • 200
  • 323

2 Answers2

7

TL;DR: dcpromo /forceremoval.

Straight from the AskDS blog:

To correct this situation we need to do the following on the DC that has the roll back issue.

1) Forcefully demote the DC by running dcpromo /forceremoval. This will remove AD from the server without attempting to replicate any changes off. Once it is done and you reboot the server and it will be a standalone serve in a workgroup.

2) Run a metadata cleanup of the DC that was demoted per KB article 216498 on one of the replication partners.

3) If the demoted server held any of the FSMO (Flexible Single Master Operations) roles then use the KB article 255504 to seize the roles to another DC.

4) Once replication has occurred end to end in your environment you can rejoin the demoted server back to the domain then promote to a DC.

You might have shot yourself in the foot when you did this:

I isolated the server from the network, launched the demote process and, when asked, told it it was the last DC in the domain; but it still complained about this not being true.

So I removed all other DCs from its copy of the Active Directory, and then did the same as above; but even this failed again, with an error about being unable to replicate a directory partition (to who? It was supposed to be the only DC around!).

If the advice I pasted above does not work, you should probably burn a support call to MS (and pray that they'll still support you after what you've done.)

Edit: Just to be clear, the answer to your title question, "How can I save a domain controller after a USN rollback?" is "you don't."

I mean, you don't have to completely rebuild the machine, (though most people, including me, would advise you to,) but its use as a DC currently is over. Force remove AD from it, unjoin it from the domain, metadata cleanup on what's left of your domain, fully replicate and ensure the domain is healthy, then rejoin, and finally repromote.

Ryan Ries
  • 55,481
  • 10
  • 142
  • 199
  • Didn't know about /forceremoval, I'll try it on Monday. – Massimo Jul 19 '13 at 18:58
  • I'm perfectly fine with demoting the server, that's *exactly* what I want to do (but I can't). I'd just like to avoid completely rebuilding it. – Massimo Jul 19 '13 at 19:02
  • BTW, why should having removed from this DC all references to the other ones have done any harm? How could it have possibly *worsened* the situation? – Massimo Jul 19 '13 at 19:02
  • 1
    It probably didn't, /forceremoval will probably still work fine for you as prescribed above. As long as we agree that this machine will never connect to the domain again until it no longer thinks that it's a domain controller. ;) – Ryan Ries Jul 19 '13 at 19:07
2
  • Do you have a loopback adapter installed? (hint: install it if not)
  • Are there any other DNS servers configured in the NIC settings? (hint: if there are, remove them)
longneck
  • 23,082
  • 4
  • 52
  • 86
  • The server is connected to an isolated switch, so the NIC is up & running; I've of course configured it to use itself as its DNS server. – Massimo Jul 19 '13 at 18:59