How to Demote a Long-Disconnected Domain Controller

Just looking back on some old notes.

Found out nearly 4 years ago that I had to reconnect a branch office Windows Server 2003 domain controller that had a reasonable amount of data (in DFS) and apps on it and I had a weekend in which to do it. A re-install would have been pushing it. Especially the DFS replication (don't even ask about the backups...).

I distinctly remember at the time that there wasn't anything on TechNet, except one of those teaser PowerPoint presentations saying how Windows Server 2003 had better support for long-disconnected domain controllers (which I can no longer seem to find with Google. Hmph.).

Some of my Kerberos experience on FreeBSD and - at that time - my new-found knowledge of pointing Google at Microsoft to search for useful information helped me to try to understand what was going on.

After having a good guess of what I thought was wrong and running down some dead-ends, I ended up surprising myself when the following process worked:

• Change tombstone on FSMO DC to 180 days
• Push out changes from FSMO DC to other DCs using replmon
• Remove GC role from long-disconnected DC on both FSMO DC and on long-disconnected DC using AD Sites and Services
• Push out changes from FSMO DC to other DCs using replmon
• Stop and Disable KDC on long-disconnected DC
• Use netdom to reset machine account password for long-disconnected DC on FSMO DC
• netdom resetpwd /server:<FSMO DC hostname> /ud:<Domain>\<Admin Account> /pd:<Admin Passwd>
• restart long-disconnected DC
• Use dcpromo repeatedly to demote server (I got timeouts for netlogon taking too long to respond; WAN authentication latency problem?)
• restart the now demoted long-disconnected DC
• Click OK to "one or more services failed to start"; not finding a DC
• Use Terminal Services to remove demoted DC as a DNS NS from AD-integrated zones on the FSMO DC
• Use Terminal Services to connect to FSMO DC and replicate the entire domain
• run dcpromo to promote standalone server

Thought I'd post this to help out any other poor sod stuck in this sorry state.

Might just have to run up a couple of VMs to verify this still works...

TechNet now has guidance on this with the Reconnecting a Domain Controller After a Long-Term Disconnection article. Doesn't look like what I've got above.

MSDE2000 Installation Error on Windows 2003 DCs

Well I've just spent the last few hours trying to install Sophos Enterprise Console 1.0 on 3 Windows Server 2003 systems. One of the server installs worked just fine and the other two failed with the following message:

Error 3500. The custom action "InstallMSDE" failed with the following error: Fatal error during installation. 1603

A Google search using "sophos error 3500" yielded nothing useful. A search of "sophos error 1603" proved more valuable. It pointed me in the direction of looking in the MSDE install log (C:\Documents and Settings\Administrator\Local Settings\Temp\SophosMSDEInstaller.log in this case). The line of interest was:

InstallSQLAgentSecurity failed (SERVER02,LocalSystem,87).

A Google search for "InstallSQLAgentSecurity failed" then yielded "Backup Exec 9.x or 10.0 for Windows Servers fails to install ..." which detailed the exact problem, but with Veritas Backup Exec 9.x/10.x.

One of the links included in this document was "PRB: The MSDE Installation Does Not Succeed If the Installation Computer Is Running Terminal Services in Application Server Mode".
The problem with this was I wasn't meeting all the criteria - I was using VNC to remotely install the software after it failed first time. Long experience with software installation on a W2K3 system even when accessing the console session over RDP has resulted in VNC being installed on my W2K3 systems.
Further wading through the Google result set then gave me this: "Solution for the WSUS/WMSDE install error"

This accurately described my problem - MSDE failing with the same error. Not only that, but it explained why one of my servers installed Sophos Enterprise Console correctly - it was the one with the FSMO roles! I excitely followed the instructions in the Microsoft Knowledge Base article titled "How to view and transfer FSMO roles in Windows Server 2003" and yay! A successful installation.
Performed the FSMO transfer again on the third server, then went home for much needed food and sleep.
Must allocate some time for the next time I need to do this to see exactly which FSMO role needs transferring.