PowerEdge: How to Force Demotion of an Active Directory Domain Controller

During a normal demotion, an Active Directory (AD) domain controller (DC) must contact another DC to let it know that the demotion is taking place. This allows the demoted DC to be removed from the replication topology so that its partners no longer attempt to contact it for replication. However, in some situations, a DC may not be able to contact another DC in the domain. If this condition cannot be resolved, a forced demotion can be performed to demote the affected DC without contacting another DC.

Forced demotion should be considered a last resort when there is no practical way to restore normal communication between the affected DC and its partners. After a forced demotion, the demoted DC's metadata must be manually deleted from Active Directory. Also, if the demoted DC held any Flexible Single Active Operations (FSMO) roles, another DC must seize those roles.

Any changes to AD data that were initiated on the demoted DC but never replicated to another DC will be permanently lost after a forced demotion.

Perform the following steps to force the demotion of a DC:

1. From the Manage menu of Server Manager, select Remove Roles and Features.
2. Click Next on the Before you begin screen.
3. Ensure that the correct DC is selected, then click Next.
4. On the Remove Server Roles screen, clear the box labeled Active Directory Domain Services.
5. In the window that appears, indicate whether to remove the associated management tools. If the server is to be repromoted to a DC, the management tools should be left in place. Otherwise, they can be removed. Click Next to proceed.
6. An error appears, indicating that the DC must be demoted before the AD DS role can be removed. Click Demote this domain controller.
7. In the window that appears, select the box labeled Force the removal of this domain controller. It may take a few seconds for this checkbox to be enabled. If necessary, click the Change button to supply credentials for the demotion operation. Note the reminder that a metadata cleanup must be performed, then click Next when ready to proceed.
8. If prompted, select the box labeled Proceed with removal and click Next.
9. Set the new local Administrator password and confirm it. Remember this password, as the server is placed in a workgroup once the forced demotion has completed. The local Administrator account is then the only one available. Click Next to proceed.
10. The next screen summarizes the operation about to be performed. You may click View script to see the equivalent PowerShell command. Click Demote to proceed.
11. The demotion may take a few minutes. When complete, a notification appears indicating that Windows is shutting down in less than a minute. It typically shuts down within a few seconds.
12. When the server reboots, log in to the local Administrator account.

The forced demotion is complete. The server is no longer a DC, though the Active Directory Domain Services role is still present. The role should be removed if the server is not to be repromoted.

As previously mentioned, the demoted DC's metadata must now be manually deleted from Active Directory. To perform this procedure, see How to Perform an Active Directory Metadata Cleanup. After the metadata cleanup has been performed, the server can be rejoined to the domain or repromoted to a domain controller.

The following video demonstrates the forced demotion procedure:

Force Demotion of an Active Directory domain controller

Further information:

• How long does it take to demote a domain controller?

• Normal Demotion:

• Forced Demotion:

• Microsoft article

​​​​​​​Demote Domain Controllers and Domains