Demoting first domain controller causing problems with the new PDC.

[RimpocheTheCat]

Hi all. I'm a desktop guy that is suddenly a server guy! I'm still a little behind in my AD, which is the heart of my issue...

The short: Any tips on finding where the first domain controller in a domain might be referenced that would cause trouble when trying to run without that DC powered on? All FISMO rolls are held by another server.

The long: I'm demoting the first DC (a Win2k server box) in a domain, following the MS KB article and some notes from Petri.co. I made sure all the FISMO roles are held by the new DC, then powered down the old DC without DCPROMOing -- just incase something broke. Yet, even with all the roles held by the new server, after a reboot of my new DC, the new DC refused to finish building its network connections and simply sat there on the grey bootup screen short of the login box. When I tried to RDP in, it said the domain did not exist. My manager is 100% sure it is the old DC being somehow part of AD still, since once we powered the old DC on, the new DC would boot up with only a slight delay while building network connections. I'm thinking I need to do LDAP queries to see where else the old DC is reference in the objects in our domain.

Anyone had something like this happen to them in the past? Is the fact that I powered down the old DC without demoting it causing this?

I'm plugging away at my AD book, but I'm not quite there yet. Any help would be wildly appreciated.

 

[58sniper]

Did you make the new DC a GC?
Did you install DNS on the new DC, and is it pointing to itself for DNS?
In DHCP, is DNS updated to reflect the new DC?
Is the new DC in the correct site in AD Sites & Services? Are the subnets there?

What do the event logs say?

Pat Richard MVP

 

[ITPangaeaArchitect]

you didnt point your new dc to itself for dns...its the pdc now, so it should point to itself and itself only for dns. the other dcs should point to him first and themselves second. sounds like you kept it pointing to the other dc..leftovers from the dcpromo. it should time out after ~45 minutes and come to a logon prompt, but you may have to hit safe mode and alter the registry to change the dns server (or safe mode with networking and use tcp/ip props as normal)

-Brandon Wilson
MCSE:Security00/03
MCSA:Messaging00
MCSA:Security03
A+