Recommended Posts

I have a Domain Controller in my Active Directory that doesn't exist. If I look in the Domain Controller container it shows up in there. Obviously it hasn't been remove properly (I don't know the reason) I need to remove it because I believe it is causing errors in my event log.

Has anyone ever done this or can someome point me to some documentation.

Thank you

Link to comment
https://www.neowin.net/forum/topic/321171-ghost-domain-controller-in-ad/
Share on other sites

2 second google search...this should do it for you. I've done this once a looong time ago.

Windows 2000 tracks each domain controller (DC) in the metadata. If you remove a DC (e.g., through reinstallation or hardware removal) and you don?t run DCPROMO to clean up the DC?s metadata, connection objects will remain.

You can use the utility NTDSUTIL to remove a server from the metadata. (In the following code, enter the commands in bold.)

D:\>ntdsutil

ntdsutil: metadata cleanup

metadata cleanup: select operation target

Next, you must connect to a server. In my example, I select a domain to accomplish this task. (In the following code, enter the commands in bold.)

select operation target: connections

server connections: connect to domain savilltech.com

Binding to \\TITANIC.savilltech.com ...

Connected to \\TITANIC.savilltech.com using credentials of locally logged on user

server connections: quit

Next, you must select a site, a server (i.e., the server you want to delete), and the domain the server is in. The order isn?t important. (In the following code, enter the commands in bold.)

select operation target: list sites

Found 2 site(s)

0 - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

1 - CN=Kent,CN=Sites,CN=Configuration,DC=savilltech,DC=com

select operation target: select site 0

Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

No current domain

No current server

No current Naming Context

select operation target: list servers in site

Found 4 server(s)

0 - CN=TITANIC,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

1 - CN=TITUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

2 - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

3 - CN=TRINITY,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

select operation target: select server 2

Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

No current domain

Server - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

DSA object - CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

DNS host name - MORPHEUS.deleteme.savilltech.com

Computer object - CN=MORPHEUS,OU=Domain Controllers,DC=deleteme,DC=savilltech,DC=com

No current Naming Context

select operation target: list domains

Found 3 domain(s)

0 - DC=savilltech,DC=com

1 - DC=dev,DC=savilltech,DC=com

2 - DC=deleteme,DC=savilltech,DC=com

select operation target: select domain 0

Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

Domain - DC=savilltech,DC=com

Server - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

DSA object - CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

DNS host name - MORPHEUS.deleteme.savilltech.com

Computer object - CN=MORPHEUS,OU=Domain Controllers,DC=deleteme,DC=savilltech,DC=com

No current Naming Context

select operation target: quit

Next, remove the server you selected. (In the following code, enter the command in bold.)

metadata cleanup: remove selected server

In the confirmation dialog box, which the Screen shows, click Yes.

ntdsutilremoveserver.gif

Close the utility. (In the following code, enter the commands in bold.)

"CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

" removed from server "\\TITANIC.savilltech.com"

metadata cleanup: quit

ntdsutil: quit

Disconnecting from \\TITANIC.savilltech.com ...

Finally, you need to delete the server from the Microsoft Management Console (MMC) Active Directory Sites and Servers snap-in. Select Programs, Administrative Tools, Active Directory Sites and Services from the Start menu. Expand the Sites branch, select the site, expand the Services container, right-click the server, and select Delete. Click Yes in the confirmation dialog box. I have been informed of a possible problem with this is SP2 is installed in which case perform on a box without SP2 installed.

Alright I have deleted it and it was pretty cool because it asked me the reason why I wanted to delete that object. I choose because the DC wasn't online anymore and could not be remove using dcpromo. Time will tell if the error problems have been resolved

Thank for the help and have fun !!!

  • 10 years later...
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Just hope it will not be as bad as History of the World: Part II...
    • +1 for LibreOffice. At least you should try it. The one from M$ is just a bloated turd at this point.
    • Yeah, I've had a Recycle Bin on my taskbar since XP and till last year when I got a new laptop with Windows 11. It was especially useful for touch workflow - I could drag files into Recycle Bin from anywhere because my Taskbar is always visible, unlike desktop icons.
    • Not after SP1. There was a legitimate file copy issue prior.
    • Microsoft 365 security in the spotlight after Washington Post hack by Paul Hill The Washington Post has come under cyberattack which saw Microsoft email accounts of several journalists get compromised. The attack, which was discovered last Thursday, is believed to have been conducted by a foreign government due to the topics the journalists cover, including national security, economic policy, and China. Following the hack, the passwords on the affected accounts were reset to prevent access. The fact that a Microsoft work email account was potentially hacked strongly suggests The Washington Post utilizes Microsoft 365, which makes us question the security of Microsoft’s widely used enterprise services. Given that Microsoft 365 is very popular, it is a hot target for attackers. Microsoft's enterprise security offerings and challenges As the investigation into the cyberattack is still ongoing, just how attackers gained access to the accounts of the journalists is unknown, however, Microsoft 365 does have multiple layers of protection that ought to keep journalists safe. One of the security tools is Microsoft Defender for Office 365. If the hackers tried to gain access with malicious links, Defender provides protection against any malicious attachments, links, or email-based phishing attempts with the Advanced Threat Protection feature. Defender also helps to protect against malware that could be used to target journalists at The Washington Post. Another security measure in place is Entra ID which helps enterprises defend against identity-based attacks. Some key features of Entra ID include multi-factor authentication which protects accounts even if a password is compromised, and there are granular access policies that help to limit logins from outside certain locations, unknown devices, or limit which apps can be used. While Microsoft does offer plenty of security technologies with M365, hacks can still take place due to misconfiguration, user-error, or through the exploitation of zero-day vulnerabilities. Essentially, it requires efforts from both Microsoft and the customer to maintain security. Lessons for organizations using Microsoft 365 The incident over at The Washington Post serves as a stark reminder that all organizations, not just news organizations, should audit and strengthen their security setups. Some of the most important security measures you can put in place include mandatory multi-factor authentication (MFA) for all users, especially for privileged accounts; strong password rules such as using letters, numbers, and symbols; regular security awareness training; and installing any security updates in a timely manner. Many of the cyberattacks that we learn about from companies like Microsoft involve hackers taking advantage of the human in the equation, such as being tricked into sharing passwords or sharing sensitive information due to trickery on behalf of the hackers. This highlights that employee training is crucial in protecting systems and that Microsoft’s technologies, as advanced as they are, can’t mitigate all attacks 100 percent of the time.
  • Recent Achievements

    • One Month Later
      Jdoe25 earned a badge
      One Month Later
    • Explorer
      Legend20 went up a rank
      Explorer
    • One Month Later
      jezzzy earned a badge
      One Month Later
    • First Post
      CSpera earned a badge
      First Post
    • One Month Later
      MIR JOHNNY BLAZE earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      618
    2. 2
      ATLien_0
      277
    3. 3
      +FloatingFatMan
      179
    4. 4
      Michael Scrip
      151
    5. 5
      Steven P.
      116
  • Tell a friend

    Love Neowin? Tell a friend!