How to Demote A Domain Controller on Windows Server?

The domain controller is a server that manages the authentication and authorization of users and computers on a Windows server. If you are looking for a way to demote a domain controller to remove it from the domain or modify its role in the network, look no further. 

To demote a domain controller, you need to remove Active Directory Domain Services role and return it to the member server.

Here, in this blog, we will discuss two scenarios and step-by-step instructions to complete the work. Let’s get started! 

How can I demote a domain controller on Windows Server?

Before moving to the methods to demote a domain controller, make sure you perform these checks: 

• If you have Windows Server 2003 or earlier, clean up the metadata using the ntdsutil command.
• Close all the services running on the server before shutting down the server. 

Once done, follow any of these methods to demote the domain controller on Windows Server 2008, 2016, and 2018

1. Use the Server Manager 

1. Go to the search bar and click the Server Manager. 
2. Select Manage and then click Remove Roles and features.
3. On the navigation pane, select AD DS or All Servers. Then, go to the Roles and Features section.
4. Now, select and right-click the Active Directory Domain Services from the list and choose the Remove Role or Feature option.
5. On the Before you begin page, click Next.
6. Now on the Server Selection page, choose the server you want to demote and click Next. 
7. Remove the checkmark next to Active Directory Domain Services on the Server Roles page. 
8. On the Remove features that require Active Directory Domain Services page, click Remove features. 
9. Click on Demote this domain controller and then OK.
10. On the next screen, remove the checkmark beside Force the removal of this domain controller. Click Next. 
11. You can change the Credentials on the next screen and click Next.
12. On the Warnings screen, place a checkmark beside Proceed with removal and click Next. 
13. Now on the Removal Options page, select Remove DNS delegation if you have DNS delegation. Click Next.
14. On the New Administrator Password window, put in the password for Password and Confirm Password fields and click Next. 
15. Now on the Review Options page, click Demote. 

Tip

If there are additional domain controllers to remove, you can click View script to generate a PowerShell script to automate the steps. 

2. Use the manual method: If the server is dead or out of reach

2.1 Removing domain controller

1. Press Windows + R to open the Run window.
2. Type dsa.msc and press Enter to open Active Directory Users and Computers.
3. Locate the Domain Controllers folder. Then, right-click the domain controller you want to remove and click Delete. 
4. Click Yes on the following prompt.
5. On the Deleting Domain Controller page, place a checkmark next to Delete this Domain Controller anyway. It is permanently offline and can no longer be removed using the removal wizard. Click Delete. 
6. Click Yes. 

2.2 Remove the DC server instance

1. Go to Server Manager, then click Tools.
2. Select Active Directory Sites and Services.
3. Expand the Sites, right-click the server you want to remove, and select Delete.
4. Click Yes to confirm the action.

2.3 Remove metadata using Command Prompt

1. Press Start and locate Command Prompt (Admin).
2. Type the following command and press Enter: ntdsutil 
3. You will get a metadata cleanup prompt. Type the following command and replace servername with the name of the targeted domain controller and press Enter:  remove selected server <servername>
4. Click Yes to proceed.

How long does it take to demote a domain controller?

Usually, it takes a couple of minutes to demote a domain controller. However, the exact time can’t be stipulated as it depends upon various things, including the number of domain controllers, the size of Active Directory, and available network bandwidth.

So, these are two methods that you can use to demote the domain controllers you want. Try any of them and let us know which way worked for you in the comments section below.