故障：不能 demote 域控制器

目录

故障现象

故障处理

参考链接

---

故障现象

1、域控制器为 Windows Server 2008 R2 旧服务器，需要迁移到一台 Windows Server 2019 新服务器中。

2、新服务器已完全成功配置为域控制器，一切正常。

3、将旧服务器降级域控制器时，报错称不能将残余数据迁移到新服务器中。

4、在旧服务器中，查看 Windows Event Viewer，在 Directory Service 出现 2 条错误和警告信息：

1）ID=2091 ActiveDirectory_DomainService

Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Event ID:      2091
Task Category: Replication
Level:         Warning
Keywords:      Classic
User:          ANONYMOUS LOGON
Description:
Ownership of the following FSMO role is set to a server which is deleted or does not exist.
Operations which require contacting a FSMO operation master will fail until this condition is corrected.
FSMO Role: CN=Infrastructure,DC=DomainDnsZones,DC=contoso,DC=com
FSMO Server DN: CN=NTDS Settings\0ADEL:051ce8ad-4935-46b5-b81c-42c36471ff59,CN=WIN-PUASFMS4ADQ\0ADEL:18162f40-22ac-4c54-ad7f-aa0269442b68,CN=Servers,CN=IDC,CN=Sites,CN=Configuration,DC=contoso,DC=com
User Action:
1. Determine which server should hold the role in question.
2. Configuration view may be out of date. If the server in question has been promoted recently, verify that the Configuration partition has replicated from the new server recently.  If the server in question has been demoted recently and the role transferred, verify that this server has replicated the partition (containing the latest role ownership) lately.
3. Determine whether the role is set properly on the FSMO role holder server. If the role is not set, utilize NTDSUTIL.EXE to transfer or seize the role. This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com.
4. Verify that replication of the FSMO partition between the FSMO role holder server and this server is occurring successfully.
The following operations may be impacted:
Schema: You will no longer be able to modify the schema for this forest.
Domain Naming: You will no longer be able to add or remove domains from this forest.
PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory Domain Services accounts.
RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups.
Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed.

2）ID=2022 ActiveDirectory_DomainService

Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Event ID:      2022
Task Category: Replication
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Description:
The operations master roles held by this directory server could not transfer to the following remote directory server.
Remote directory server:
\\New-DC.contoso.com
This is preventing removal of this directory server.
User Action
Investigate why the remote directory server might be unable to accept the operations master roles, or manually transfer all the roles that are held by this directory server to the remote directory server. Then, try to remove this directory server again.
Additional Data
Error value:
5005 The directory service is missing mandatory configuration information, and is unable to determine the ownership of floating single-master operation roles.
Extended error value:
0
Internal ID:
52498782

故障处理

1、创建脚本：

'-------fixfsmo.vbs------------------
const ADS_NAME_INITTYPE_GC = 3
const ADS_NAME_TYPE_1779 = 1
const ADS_NAME_TYPE_CANONICAL = 2


set inArgs = WScript.Arguments


if (inArgs.Count = 1) then
    ' Assume the command line argument is the NDNC (in DN form) to use.
    NdncDN = inArgs(0)
Else
    Wscript.StdOut.Write "usage: cscript fixfsmo.vbs NdncDN"
End if


if (NdncDN <> "") then


    ' Convert the DN form of the NDNC into DNS dotted form.
    Set objTranslator = CreateObject("NameTranslate")
    objTranslator.Init ADS_NAME_INITTYPE_GC, ""
    objTranslator.Set ADS_NAME_TYPE_1779, NdncDN
    strDomainDNS = objTranslator.Get(ADS_NAME_TYPE_CANONICAL)
    strDomainDNS = Left(strDomainDNS, len(strDomainDNS)-1)


    Wscript.Echo "DNS name: " & strDomainDNS


    ' Find a domain controller that hosts this NDNC and that is online.
    set objRootDSE = GetObject("LDAP://" & strDomainDNS & "/RootDSE")
    strDnsHostName = objRootDSE.Get("dnsHostName")
    strDsServiceName = objRootDSE.Get("dsServiceName")
    Wscript.Echo "Using DC " & strDnsHostName


    ' Get the current infrastructure fsmo.
    strInfraDN = "CN=Infrastructure," & NdncDN
    set objInfra = GetObject("LDAP://" & strInfraDN)
    Wscript.Echo "infra fsmo is " & objInfra.fsmoroleowner


    ' If the current fsmo holder is deleted, set the fsmo holder to this domain controller.


    if (InStr(objInfra.fsmoroleowner, "\0ADEL:") > 0) then


        ' Set the fsmo holder to this domain controller.
        objInfra.Put "fSMORoleOwner",  strDsServiceName
        objInfra.SetInfo


        ' Read the fsmo holder back.
        set objInfra = GetObject("LDAP://" & strInfraDN)
        Wscript.Echo "infra fsmo changed to:" & objInfra.fsmoroleowner


    End if


End if

2、执行脚本命令：

cscript fixfsmo.vbs DC=DomainDnsZones,DC=contoso,DC=com

3、在旧服务器中，执行降级域控操作，OK！

参考链接

"Adprep could not contact a replica" error when running "Adprep /rodcprep" commandhttps://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/error-run-adprep-rodcprep-command