Making Secondary Domain Controller the Primary?

[[BB] Rick James]

I'm getting rid of my main Domain Controller. It's a littler older and etc. I'd like to take my secondary and make it my primary, how can this done?

 

[abudhu]

You will need to sieze / transfer the roles. To do this you will need to use Ntdsutil in Windows 2003 Server.

Here are two links to get you on your way:

http://www.petri.co.il/transferring_fsmo_roles.htm

http://support.microsoft.com/kb/255504

 

[[BB] Rick James]

You will need to sieze / transfer the roles. To do this you will need to use Ntdsutil in Windows 2003 Server.

Here are two links to get you on your way:

http://www.petri.co.il/transferring_fsmo_roles.htm

http://support.microsoft.com/kb/255504

What if the primary is unresponsive and you can't even access the box anymore? then what?

Also, what if you just delete it in Active Directory on the Secondary DC and just say "Denote but keep using as a computer"? Would that promote the secondary DC as the primary then? AC and DNS are both update todate on both DCs.

 

[oakfan52]

What if the primary is unresponsive and you can't even access the box anymore? then what?

Also, what if you just delete it in Active Directory on the Secondary DC and just say "Denote but keep using as a computer"? Would that promote the secondary DC as the primary then? AC and DNS are both update todate on both DCs.

Then you have to sieze the FSMO's and do cleanup ......


http://support.microsoft.com/kb/332199

http://support.microsoft.com/kb/216498

http://www.petri.co.il/delete_failed_dcs_from_ad.htm

 

[jpochedl]

I didn't check the links, so this may have been answered by one of the links previously submitted... But....

The easiest thing to do is run DCPROMO again on the server that you want to demote (stop being an AD controller). DCPromo will demote the box gracefully and, in the process, transfer the FSMO roles to another AD controller.

However, I'd just like to point out that it's good practice to have at least two DC's in an enviorment. That way, if one goes offline (hardware blows up, etc) at least functions that require authentication, such as file and print sharing, domain logins, Exchange, IIS authentication (where domain accounts are used for security, like Sharepoint services), etc etc won't break because there's no extra DC to authenticate against. Maybe you have three DCs in place now and are just removing one... Thought I'd bring it up just to be on the safe side though.

Edit: If your primary DC is also doing DNS, make sure you account for changes in your DNS structure too!