Off Campus

Michael Greene

Blogs

What is the simplest command line to dcpromo *down* a Server Core machine?

  • Comments 2
  • Likes

In my test environment I just discovered an issue and need to remove the Domain Controller role from one of my Hyper-V hosts which happens to be running Server Core.  This brought a question to mind, if I want to demote a DC running Core, what is the path of least resistance?

I found that if I am willing to accept all default parameters I could do it with just one command line argument –

dcpromo /AdministratorPassword:<password>

To review the default parameters, type “dcpromo /?:Demotion”.  Unfortunately my RDP session closed before I could copy/paste the full output of the command.  If anyone captures it, feel free to drop it in the comments.  It basically confirms each step of removing the role, dns records, binaries, etc.  Note that if your DC is the last DC within the domain you would need to specify additional parameters.

Comments
  • What a dangerous and yet sweet command!  Haha, I was about to capture it for you... but then it rebooted!

  • Hello,

    Here are the output :)

    The following is a list of unattend parameters for demotion (default values are enclosed in <>):

    /AdministratorPassword:"administrator password" default is empty password

    Specifies a local administrator account password when demoting a domain controller.

    /DemoteFSMO:{Yes | <No>}

    Indicates that (forced) demotion should continue even if a FSMO role is discovered on domain controller being demoted.

    /DNSDelegationPassword:{"password" | *}

    Specifies the password for the user name (account credentials) to use for creating or removing DNS delegation. Specify * to prompt the user to enter credentials.

    /DNSDelegationUserName:"user_name"

    Specifies the user name (account credentials) used for creating or removing DNS delegation. If no value is specified, the credentials used for the domain controller installation or removal are used.

    /IgnoreIsLastDcInDomainMismatch:{Yes | <No>} default causes the wizard to prompt the user to continue and causes the command-line tool to exit with an error.

    Specifies whether to continue the demotion of the domain controller when either the switch /IsLastDCInDomain:Yes is specified and dcpromo detects that there is actually another active domain controller in the domain, or when the switch /IsLastDCInDomain:No is specified and dcpromo cannot contact any other domain controller in the domain.

    /IgnoreIsLastDNSServerForZone:{Yes | <No>}

    Specifies whether to continue demotion despite that the domain controller is the last DNS server for one or more of the Active Directory-integrated DNS zones that it hosts.

    /IsLastDCInDomain:{Yes | <No>}

    Specifies whether the computer which is being demoted is the last domain controller in the domain.

    /Password:{"password" | *}

    Specifies the password corresponding to the user name (account credentials) used for the operation. Specify * to prompt the user to enter credentials.

    /RebootOnCompletion:{<Yes> | No}

    Specifies whether to restart the computer upon completion, regardless of success.

    /RebootOnSuccess:{<Yes> | No | NoAndNoPromptEither}

    Specifies whether to restart the computer upon successful completion.

    /RemoveApplicationPartitions:{Yes | <No>}

    Specifies whether to remove application partitions during the demotion of the domain controller.

    /RemoveDNSDelegation:{<Yes> | No}

    Specifies whether DNS delegations pointing to this DNS server should be removed from the parent zone.

    /RetainDCMetadata:{Yes | <No>}

    Specifies to retain domain controller metadata in the domain after AD DS removal. Delegated read-only domain controller (RODC) administrators should specify this option to demote an RODC.

    /UserDomain:"domain_name"

    Specifies the domain name for the user name (account credentials) used for the operation. It also helps to specify the forest where you plan to install the domain controller or create an RODC account. If no value is specified, the domain of the computer will be used.

    /UserName:"user_name"

    Specifies the user name (account credentials) used for the operation. If no value is specified, the credentials of the current user are used for the operation.

    Press any key to quit ...

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment