Saturday, May 21, 2011

Active Directory Transfer, Demote, and Disjoin

To continue from yesterday, I wasn't comfortable with a domain controller that had been restored from system state from different hardware (that was then repaired), so I brought up another virtual Windows Server 2003 machine to replicate Active Directory and transfer operations masters roles to. Then I wanted to demote the original virtual server and disjoin the domain. When transferring roles, you have to connect the tools to the domain controller you want to transfer the operations masters to and click Change:

1) Open Active Directory Domains and Trusts and connect to destination DC (Right-click Active Directory Domains and Trusts icon in the top of the tree, click Connect to Domain Controller, choose the destination domain controller and click OK). Right-click Active Directory Domains and Trusts and click Operations Master. Click Change, click Yes, and click OK

2) Open Active Directory Sites and Services. Expand Active Directory Sites and Services - Sites - - Servers - - NTDS Settings and make sure the DC is a Global Catalog server (GC is checked).

3) Open Active Directory Users and Computers and connect to destination DC. Expand Active Directory Users and Computers, right-click domain.local, and click Operations Master. In the RID tab, Click Change, click Yes, click OK. In the PDC tab, Click Change, click Yes, click OK
In the Infrastructure tab, Click Change, click Yes, click OK

4) Click Start - Run, type regsvr32 schmmgmt.dll and click OK. Click Start - Run, type mmc and click OK. Click File - Add/Remove Snap-in. Click Add, select Active Directory Schema, click Add and click OK. Click OK. Right-click Active Directory Schema, click Change Domain Controller and change to the destination DC. Right-click Active Directory Schema, click Operations Master
Click Change, click Yes, click OK.

5) Demote DC. Run DCPROMO. Click Next (welcome), click OK to the warning (gc), click Next, type in the new local administrator password and click Next, click Next,

6) Disjoin the Domain (Right-click My Computer and click Properties, click the Computer Name tab, click Change, change domain to workgroup, pick a workgroup name and click OK, OK. Restart.

No comments:

Post a Comment