Page 41 – Azure365Pro.com

Domain Controller Metadata Cleanup Denied

Satheshwaran Manoharan

-

April 21, 2019

Domain Controller Metadata Cleanup Denied

Metadata Cleanup Fails with DsRemoveDsServerW error 0x5(Access is denied.)


Microsoft Windows [Version 6.3.9600]

(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ntdsutil
ntdsutil: metadata cleanup
metadata cleanup: connection
server connections: connect to server AZURE365PRO-LIVEDC
Binding to AZURE365PRO-LIVEDC ...
Connected to AZURE365PRO-LIVEDC using credentials of locally logged on user.
server connections: quit
metadata cleanup: select operation target
select operation target: list domains
Found 1 domain(s)
0 - DC=azure365pro,DC=com
select operation target: select domain 0
No current site
Domain - DC=azure365pro,DC=com
No current server
No current Naming Context
select operation target: list sites
Found 2 site(s)
0 - CN=AD-000,CN=Sites,CN=Configuration,DC=azure365pro,DC=com
1 - CN=AD-001,CN=Sites,CN=Configuration,DC=azure365pro,DC=com
select operation target: select sit 0
Site - CN=AD-000,CN=Sites,CN=Configuration,DC=azure365pro,DC=com
Domain - DC=azure365pro,DC=com
No current server
No current Naming Context
select operation target: list servers in site
Found 3 server(s)
0 - CN=AZURE365PRO-DEADDC,CN=Servers,CN=AD-000,CN=Sites,CN=Configuration,DC=azure365pro,DC=com
1 - CN=AZURE365PRO-DC03,CN=Servers,CN=AD-000,CN=Sites,CN=Configuration,DC=azure365pro,DC=com
2 - CN=AZURE365PRO-LIVEDC,CN=Servers,CN=AD-000,CN=Sites,CN=Configuration,DC=azure365pro,DC=com
select operation target: select server 0
Site - CN=AD-000,CN=Sites,CN=Configuration,DC=azure365pro,DC=com
Domain - DC=azure365pro,DC=com
Server - CN=AZURE365PRO-DEADDC,CN=Servers,CN=AD-000,CN=Sites,CN=Configuration,DC=azure365pro
,DC=com
DSA object - CN=NTDS Settings,CN=AZURE365PRO-DEADDC,CN=Servers,CN=AD-000,CN=
Sites,CN=Configuration,DC=azure365pro,DC=com
DNS host name - AZURE365PRO-DEADDC.azure365pro.com
Computer object - CN=AZURE365PRO-DEADDC,OU=Domain Controllers,DC=azure365pro,DC=com
No current Naming Context
select operation target: quit
metadata cleanup: remove selected server
Transferring / Seizing FSMO roles off the selected server.
DsRemoveDsServerW error 0x5(Access is denied.)
metadata cleanup:

Solution –

Make Sure all objects which you trying to remove “Protect Object from Accidental deletion” is unchecked in Active Directory Sites and Services.

Decommissioning Child Domain gracefully – Operation Failed

Satheshwaran Manoharan

-

April 2, 2019

2

If the domain is a Child domain and if you wish to delete Child domain entries / Trust from the root forest.

We need to Choose “Delete the domain because this server is the last domain controller in the domain”

We received an error while decommissioning the child domain

The Operation Failed because :

Active Directory Domain Services Could not be removed on this Active Directory Domain Controller because this is the last AD DC in the domain, and the domain has a child directory partition

DC=DomainDnsZones,DC=domain,DC=com.

Use ntdsutil to Delete the Child domain

Open the CMD prompt
NTDSUtil
Domain Management (In 2008 it changes to “partition management”)
Connections => connect to server DC01
Quit
List <— to see zones
Delete NC DC=DomainDNSZones,DC=Domain DC=Com (This Deletes the CrossRef Object)
Force replication, validate that the partition is gone.
Restart DNS, the service will re-add the partition.

Now Demote the Last domain in the Child domain. it should allow you to demote without any issues.

Moving Mailboxes from Child domain to root domain.

Satheshwaran Manoharan

-

March 1, 2019

0

In my Scenario _

Root Domain – A.com

Child Domain – B.com

–

Customer wants to get rid of B.com and its Exchange servers. So that he move forward to migrate to the cloud. Without involving B.com

Let’s move

B.com (Child Domain)

testeuro15@B.com

testeuro17@B.com

to

A.com (Root Domain)

testeuro15@B.com

testeuro17@B.com

_

Member of

Distribution Group and a Security Group
Mailbox Active on iPhone

_

As Child Domain and Root Domain are in the same Exchange Forest. (They can see and Connect each other without any issues)

New local Move Request to from Child domain B.com To A.com

Once Mailbox is moved. User will go disconnected in Outlook.

Now Consider Mailbox is Moved from Child domain to root domain

–

Now go to Adsiedit.msc Default Domain Partition of Child domain. Delete any Active Sync Devices below user Object.

or you can use Exchange management shell to remove active sync device of the user.

Now Once All Devices deleted . Now ADMT knows it doesn’t have any leaf object.

Now install ADMT 3.2 on a Server which as access to Child Domain and Root domain.

Now Right Click and Click on User Account Migration Wizard.

B.com Source Domain

A.Com Child Domain

Select Users from domain.

Choose User Accounts from the Source domain.

Choose A.com OU

Update User rights.
Migrate Associated User groups

When you migrate Associate user groups. It moves Distribution group and security group objects from child domain to root domain

and if you open the distribution group and security group members . you can see the migrated users are from root domain and child domain are listed.

but the objects is migrated

Do not migrate source object if a conflict is detected in the target domain.

Groups Associated with the user got migrated.

Tried some test emails from Source and Destination domain.
Distribution list works without any issues.
New Configured Outlook Profile where autodiscover of the source domain is pointing to the destination Exchange server. As they have different DNS zones between child domain and root domain.

_

Once all mailboxes and user objects are moved from child domain to root domain.

We can remove child domain exchange server and Domain controllers without any issues.

Mailbox couldn’t be found for NT AUTHORITY\SYSTEM ECP Login Error

Satheshwaran Manoharan

-

February 23, 2019

0

$Mailbox couldn’t be found for NT AUTHORITY\SYSTEM ECP Login Error$

“ 🙁

Something went wrong

A Mailbox couldn’t be found for NT AUTHORITY\SYSTEM. If problem persists, contact your helpdesk”

Solution –

Remove Exchange server Computer Object from Administrators Group

Could not find any global catalog while Exchange server removal

Satheshwaran Manoharan

-

February 23, 2019

0

Couldn’t remove a Disaster Recovery site exchange server. Where no active directory servers exist. Which belongs to a old setup.

Setup Encountered while validating the state of Active Directory : Could not find any Global Catalog in the forest.
Setup cannot continue with the uninstall because the “beremote” () process (ID 4604) has open files . Close the process and restart setup.
Uninstall cannot Continue : Database ‘Mailbox Database 1684381753’ Could not find any Global Catalog in the forest.

Solution –

– Added a static registry to a site which is accessible and active _

Run regedit.exe from the command line or Start ? Run.

Expand HKEY_LOCAL_MACHINE ? SYSTEM ? CurrentControlSet ? Services ? Netlogon ? Parameters.
Key: Syetem\CurrentControlSet\Services\Netlogon\Parameters

Right-click on Parameters and select New ? String Value.
Name: SiteName
Type: REG_SZ

Enter SiteName for the name.
Double-click on the new value, enter the name of the site under Value data, and click OK.

Value: After adding the above registry entry, the DynamicSiteName value is ignored. DC Locator Service always uses the value stored in SiteName registry entry to query the domain controllers in that site.

– Killed beremote forest.

Re ran the uninstallation . It succeeded.