As you know, Windows Server 2012 is completely new operating system. These days, the main point from domain administrator point of view is to install and promote server as Domain Controller based on that system. That’s fine and this is obvious reason 🙂 but what if, in some case, we would like to decommission it? How we can do that?The first thing you can think of is dcpromo command. Generally, that’s true but remember, in Windows Server 2012 dcpromo cannot be used to promote/demote Domain Controller over regular way.
Oh, what a big shame:/ what can I do to decommission Windows Server 2012 Domain Controller?The answer is simple just use the new Windows Server Manager version. Thanks to that tool, you are able to decommission DC in few simple steps. Just take a look at below steps to fulfill the requirementLog on to Domain Controller based on Windows Server 2012 and run Server Manager or wait until it will show up (if you did not change its default startup mode). Then you need to decide if you wish to decommission currently logged on DC or any other (remote DC).
In case that you want to decommission remote Domain Controller just select “ All servers” node in Server Manager and choose DC from the list of available servers. Options for DC decommission processAs you can see in that window, there is new feature for forceful AD:DS role removal. You can do that from GUI now, you don’t need to run dcpromo with separate switch for that.Important!
Do not select option “Last domain controller in the domain” unless it is really decommission for the last DC. You would corrupt your AD environment.When you are demoting DC, you need to be logged on with appropriate privileges.
In case that you do not use an account which allows DC decommission, you may specify it during that process. Click on “Change” button and provide appropriate account.
If you have a domain controller that is no longer on the network, hasn’t replicated during the forest’s tombstone lifetime, or has been cleaned up in Active Directory via metadata cleanup, you’ll need to do a forced demotion in order to get the server back to a normal state. The procedure to do this varies depending on whether the server in question is running Windows Server 2012 or newer, or if it’s running a prior version of Windows Server. Windows Server 2012 and Newer (PowerShell)The easiest way to forcefully demote a Windows Server 2012 (or newer) domain controller is with the Uninstall-ADDSDomainController PowerShell cmdlet. Launch an elevated PowerShell prompt. You can do this by right clicking the PowerShell icon pinned to the taskbar:.
Next, run the following PowerShell command. You will be prompted to provide a local administrator password to be used after the server reboots.
The cmdlet will provide some progress information prior to rebooting the server.Uninstall-ADDSDomainController -ForceRemoval -DemoteOperationMasterRole. Once the server reboots, login with the local administrator password you provided in the previous step. The server is now in a workgroup. If desired, you can safely promote the server back in to service as a domain controller.Windows Server 2008 R2 and Older (DCPromo)Versions of Windows prior to Windows Server 2012 do not have a convenient PowerShell cmdlet for forceful demotion of a domain controller. Instead, you must run the DCPromo wizard with a secret parameter.
From the Run dialog, enter “dcpromo /forceremoval”. If the domain controller holds any FSMO roles, you will receive a warning for each role. Following the completion of this process, you must seize these FSMO roles on new domain controller(s) to ensure that your forest continues to function correctly.RID Master WarningPDC Emulator WarningInfrastructure Master WarningDomain Naming Master WarningSchema Master Warning.
If the domain controller is a global catalog or a DNS server, you will also be warned. In the case of DNS, ensure that clients aren’t looking to this server for their DNS needs.DNS Server WarningGlobal Catalog Warning. Once any necessary warnings have been displayed, the wizard will start. You must supply a new local administrator password. This password will be used to login to the server following the completion of the forced demotion process.
This password must comply with the domain password policy that applies to the domain controller. Once you’re sure you want to proceed, click Next to begin the process.
Demote Domain Controller 2008 R2
The demotion process will take some time to complete. The progress dialog provides information about what task is currently being performed, but no indication of overall progress.
If you didn’t check Reboot on completion, the wizard will let you know when it’s done.Once the server reboots, you should immediately seize any FSMO roles that were previously held and perform a metadata cleanup. You can then safely promote the server back to domain controller status if desired.