How To Decommission a Domain Controller (Best Practice)

In this video we cover the steps necessary to successfully decommission a domain controller in your environment. We specifically walk through transferring FSMO (Flexible Single Master Operation) roles to another DC using Powershell.

Once the DC has been decommissioned we take you step by step on the processes that are needed for post decommission and cleanup. You'll need to make sure you clean up Sites and Services, DNS and update any static IPs that may be pointing to the old, decommissioned DC. For those machines that have DHCP enabled, you would just need to update that and verify those client settings get those updated records. The steps in this video also work for Server 2016 and Server 2019 to demote a Domain Controller.

More information on transferring FSMO Roles:

00:00 Intro of video
00:11 Begin Transferring FSMO Roles
01:51 Remove AD Role and Demote DC
04:38 Post Decom Cleanup AD
05:02 Post Decom Cleanup Sites and Services
05:45 Post Decom Cleanup DNS
06:18 Post Decom Cleanup Updating DNS for static IPs

[TheSysadminChannel]

Too long didn't watch. TLDW;

00:00 - Intro
00:11 - Begin Transferring FSMO Roles
01:51 - Remove AD Role and Demote DC
04:38 - Post Decom Cleanup AD
05:02 - Post Decom Cleanup Sites and Services
05:45 - Post Decom Cleanup DNS
06:18 - Post Decom Cleanup Updating DNS for static IPs

[laurajacobs]

Fantastic! Thank you. It's a clear outline of how to proceed.

[AdmVrln]

You deserve more subs. :)
Side note - I'm an old hand and the vid shows why I don't like powershell. I know why you showed the script and in large ent, the powershell makes sense, but here, in the instance of changing the IP, the one step in UI is a very complex multi step in powershell. We've changed Windows from the winner that killed other systems with UI, ... into those systems. Thats no reflection on your excellent vid, just on the wider admin in win..

Thanks for the video!

[TheOirishhAmerican]

Great stuff, just started a new sys admin role and one project was to decom 5 dc's don't ask me why there are so many which I thought that was absurd too but that's the deal haha.

[James-sclz]

Any idea if there is any risk just shuttinbg down a DC to see if there are issues with ADDS still installed? I can not think of a single reason why this should be an issue. The idea is we leave it down for a few weeks and then bring it back online to perform the demote only. Of course there will be replication issues with the DCs and partners but thats to be expected. It will not be doewn for more than 180 days and when brought back, the DCs will just play catch up. I could remove ADDS and then power them off but I would prefer not to at this stage.

I am a subscriber. Excellent channel. Keep up the good work.

[TK-rrgj]

thanks for sharing the content! I'm not a pro but at 04:08 your porshell comandlet is set to do what you mention not to, it's forcing demotion ( -Force:$true )

[KLNYC]

do you have a video on how to migrate old DC to a new DC? thx

[Lifestyle-mffh]

Can you please let me know what is - 3, 4 meaning in that command ? I am from India .

[ierosgr]

You could explain the options of the cli commands. If you mention that they are out there to search for them the answer will be so the procedure in text guides so what is the point of the video to follow blindly .... and upon that you call it best practice?
You also checked for the DHCP and DNS roles. The point of the video would be for them to be active and not offline. You are trying to catch the most usecase scenario by other users not the easiest one