Windows 2000 DC Forced Removal Using NTDSUTIL

This article provides a comprehensive guide on executing a forced domain controller removal in Microsoft Windows 2000 using the command-line tool NTDSUTIL. When a Windows 2000 domain controller fails catastrophically or is forcefully demoted without network connectivity, its metadata remains inside Active Directory. Below, you will learn the exact sequence of commands required to clean up this orphaned metadata, how the utility interacts with the directory database, and the manual post-cleanup steps necessary to maintain domain health.

The Role of NTDSUTIL in Forced Demotions

In Windows 2000 Server (specifically following Service Pack 4, which introduced the dcpromo /forceremoval switch), a forced demotion removes Active Directory locally from the server without notifying replication partners. Because the retired domain controller cannot communicate its departure to the rest of the forest, the surviving domain controllers still attempt to replicate with it.

NTDSUTIL resolves this inconsistency through its metadata cleanup mode. Instead of performing an orderly RPC-based demotion handshake, NTDSUTIL directly purges the database objects representing the defunct server from the Active Directory database on a surviving domain controller.

Step-by-Step NTDSUTIL Execution

To purge the metadata of a forcefully removed domain controller, log on to a functional, writable domain controller with Enterprise Admin or Domain Admin privileges and execute the following procedure:

  1. Launch the Utility
    Open the Command Prompt and type:
    ntdsutil

  2. Access Metadata Cleanup
    At the ntdsutil: prompt, enter:
    metadata cleanup

  3. Establish a Server Connection
    Before modifying directory targets, connect to a running, healthy domain controller:
    connections
    connect to server <Healthy_DC_Name>
    quit

  4. Select the Target Scope
    You must set the context to identify the specific domain controller being eliminated:
    select operation target
    list domains (identify the number of the domain containing the target server)
    select domain <Number>
    list sites (identify the number of the site where the target server resided)
    select site <Number>
    list servers in site (identify the number of the dead server)
    select server <Number>
    quit

  5. Execute the Removal
    At the metadata cleanup: prompt, execute:
    remove selected server

  6. Confirm Deletion
    A dialog box appears requesting confirmation to remove the specific NTDS Settings object. Confirm the prompt to proceed. Type quit repeatedly to exit NTDSUTIL.

What NTDSUTIL Executes Internally

When you execute remove selected server, NTDSUTIL executes the following operations against Active Directory:

  • Removes the NTDS Settings Object: Deletes the CN=NTDS Settings,CN=<ServerName>,CN=Servers,CN=<SiteName>,CN=Sites,CN=Configuration,DC=... object from the Configuration naming context.
  • Severs Replication Links: Automatically removes all inbound and outbound replication connections (Connection objects) pointing to the decommissioned server across the topology.
  • Prepares the Computer Account: Marks the directory metadata so that the computer object in Active Directory Users and Computers can be safely deleted without throwing replication dependency errors.

Required Post-Cleanup Operations

NTDSUTIL in Windows 2000 does not clean every associated record automatically. To finalize the forced removal:

  • Active Directory Users and Computers: Locate the computer object of the removed server in the Domain Controllers organizational unit and manually delete it.
  • Active Directory Sites and Services: Navigate to the site where the server was located, expand the Servers container, and delete the parent server container object (the child NTDS Settings object was already removed by NTDSUTIL).
  • DNS Cleanup: Open the DNS Management console and delete all host (A) records, CNAME (alias) records, and Service Location (SRV) records associated with the decommissioned server under _msdcs, _sites, _tcp, and _udp subdomains.
  • FSMO Role Seizure: If the removed server held any Flexible Single Master Operation (FSMO) roles, use NTDSUTIL’s roles menu to seize those roles onto an operational domain controller. Never bring the original server back online once its metadata has been removed.