How to Demote an Active Directory Domain Controller using PowerShell

The Risks of Dead Domain Controllers

In an Active Directory environment, you should never have a single point of failure. A standard corporate network will have at least two, and often dozens, of Domain Controllers (DCs) constantly replicating data with one another.

If a hardware server hosting a Domain Controller reaches its end-of-life, you cannot simply unplug it and throw it in the trash. If you do, the remaining Domain Controllers will spend the next several months continuously attempting (and failing) to replicate data to the dead server, resulting in massive Event Log errors and potential Active Directory database corruption.

Before decommissioning the server, you must properly demote it. Demoting a DC gracefully transfers its operation master roles (FSMO) to another server, replicates its final changes, and completely removes its identity from the global Active Directory metadata.

Using the Uninstall-ADDSDomainController Cmdlet

While you can use the graphical Server Manager wizard to remove roles, PowerShell is far more efficient, especially if you are managing a server core installation via WinRM.

To gracefully demote the server you are currently logged into, open PowerShell as an Enterprise Administrator and execute the Uninstall-ADDSDomainController cmdlet.

Uninstall-ADDSDomainController -LocalAdministratorPassword (Get-Credential).Password -ForceRemoval $false

Breaking Down the Command:

• -LocalAdministratorPassword: When a server is a Domain Controller, it does not have a local SAM database. Once it is demoted, it becomes a standard member server again, and requires a local Administrator password to log in. This parameter securely prompts you to create that new local password.
• -ForceRemoval $false: This is the most critical parameter. By setting this to false, you are instructing Windows to perform a graceful demotion. The server will reach out to the Primary Domain Controller, sync all final data, and cleanly remove itself from the DNS records.

Upon pressing Enter, the server will evaluate its FSMO roles, transfer them if necessary, strip the Active Directory Domain Services role, and automatically restart.

The Nuclear Option: Force Removal

What if the Domain Controller you are trying to demote has been physically disconnected from the network for 6 months, or its network card is completely fried? A graceful demotion will fail because the server cannot contact the rest of the domain.

In this disaster recovery scenario, you must force the demotion.

Uninstall-ADDSDomainController -LocalAdministratorPassword (Get-Credential).Password -ForceRemoval $true

Warning: Forcing a removal means the server will violently strip Active Directory from its own local hard drive without telling anyone else on the network. This results in “metadata orphans.”

Cleaning Up the Metadata

If you were forced to use the -ForceRemoval $true command, you are not finished. Because the server could not tell the rest of the network it was leaving, all the other healthy Domain Controllers still think it exists.

You must log into a healthy Domain Controller, open the Active Directory Sites and Services graphical console, locate the dead server object, right-click it, and select Delete. Windows will recognize it as an orphaned DC and prompt you to perform a metadata cleanup, which will manually purge its DNS records and replication topology data from the global catalog.