I’ve seen this issue come up time and time again. Some administrator decided to remove an old DC from the network but forgot to remove it from Active Directory or the DC has entered a failed state and cannot be recovered from. In a perfect world DCPROMO is all you have to do to remove a DC from the environment. However, if that DC was already shutdown or DCPROMO is giving you problems you will have to remove it the manual way. That method involves using a command called NTDSUTIL. NTDSUTIL is a command line tool that allows you to perform some of the more advanced Active Directory maintenance tasks.
Below are the steps needed to remove a failed or offline Domain Controller from your environment.
TIP: NTDSUTIL does not require the full command to be entered…you only have to enter enough of the command that is unique. For Example, instead of typing metadata cleanup you could just type met cle…or better yet m c
- Open the Command Prompt
- Type ntdsutil (all the commands will be entered via this command prompt)
- Type metadata cleanup
- Type connections
- Type connect to server <ServerName> and replace <ServerName> with the name of a functional DC in your environment…even if you are logged in locally. This step is not needed post W2K3 SP1.
- Type quit
- Type select operations target
- Type lists sites
- Type select site <#> where <#> is the site where the failed or offline DC resided
- Type list servers in site
- Type select server <#> where <#> is the DC that is failed or offline
- Type list domains
- Type select domain <#> where <#> is the domain where the failed or offline DC resided (at this point you should verify that the site, server and domain are all selected)
- Type quit (this should set you back to the metadata cleanup menu)
- Type remove selected server ( a warning message will pop up…verify that this is the correct DC…in fact get a peer to verify it for you too)
- Click Yes
- Open Active Directory Sites and Services
- Expand out the site that the failed or offline DC resided in
- Verify the DC cannot be expanded out (no connection objects and such)
- Right Click the DC and select Delete
- Close Active Directory Sites and Services
- Open Active Directory Users and Computers
- Expand the Domain Controllers OU
- Delete the failed or offline DC from the OU (if it even exists)
- Close Active Directory Users and Computers
- Open DNS Manager
- Expand the zones where this DC was also a DNS server and perform the following steps
- Right click the zone and select Properties
- Click the Name Servers tab
- Remove the failed or offline DC from the Name Servers tab
- Click OK to also remove the HOST (A) or Pointer (PTR) record if asked
- Verify the zone no longer has a DNS record for the failed or offline DC
You can also find more info located on Microsoft site here and here for removing orphaned domains.
The following code can be run to display the group membership of an Active Directory group and also let you know each member’s LDAP Distinguished Name. The output will name the text file the group name and will include all the members and their location in Active Directory. Just copy this into a txt file and rename to .vbs Enjoy!
Set objGroup = GetObject("LDAP://cn=GroupName,ou=OUName,DC=DomainName,DC=local")
Set objFileSystem = CreateObject("Scripting.FileSystemObject")
Set objFile = objFileSystem.OpenTextFile(objGroup.Get("name") & " - Members.txt", 2, True, 0)
For Each objMember in objGroup.Members
objFile.WriteLine objMember.Get("sAMAccountName") & VbTab & _
objMember.Get("cn") & VbTab & _
objMember.Parent
Next
Set objFile = Nothing
Set objFileSystem = Nothing
Set objGroup = Nothing
From time to time I’ve had to figure out which user account has a specific email address. Actually its more like finding who has the “reallycoolemailaccount@company.com” so another “more senior” person can get it. Well if you work in a smaller company this can be kind of easy…but if your directory has thousands of accounts it becomes more difficult and time consuming.
What you will want to do is open up Active Directory Users and Computers and right-click the domain and select Search. Select the drop-down arrow in the Find field to select Custom Search. If you have multiple domains make sure to select Entire Directory on the In field. Now just click on the Advanced tab and put the following text in the LDAP Query - proxyaddresses=smtp:<whatever the email is you’re looking for>. Now all you have to do is click on Find Now and if the email is in use it will show the user account that is using it.
