Ntdsutil Metadata Cleanup

ntdsutil metadata cleanup

This article will show you step-by-step how to clean up Active Directory metadata after killing a domain controller.

The steps listed should only be performed in case you have no intention of bringing the domain controller back online.

Cleanup includes deleting the computer account from the domain partition as well as removing replication objects in the configuration partition.

To perform the cleanup we use the Ntdsutil tool. The Ntdsutil is found on existing domain controllers and can be installed on a client machine using the RSAT installation.

Pre-requisites

Make sure you’re a member of the Enterprise Admins group and that your command prompt is elevated with admin rights. Check both by running the “whoami /all” command:

PS C:\Users\mskadm> whoami /all

USER INFORMATION
----------------

User Name       SID
=============== =============================================
E365M\mskadm    S-1-5-21-3247909092-157580105-2477339510-1480


GROUP INFORMATION
-----------------

Group Name                                      Type             SID                                            Attributes
=============================================== ================ ============================================== ===============================================================
Everyone                                        Well-known group S-1-1-0                                        Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                                   Alias            S-1-5-32-545                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access      Alias            S-1-5-32-554                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                          Alias            S-1-5-32-544                                   Mandatory group, Enabled by default, Enabled group, Group owner
NT AUTHORITY\REMOTE INTERACTIVE LOGON           Well-known group S-1-5-14                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE                        Well-known group S-1-5-4                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users                Well-known group S-1-5-11                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization                  Well-known group S-1-5-15                                       Mandatory group, Enabled by default, Enabled group
LOCAL                                           Well-known group S-1-2-0                                        Mandatory group, Enabled by default, Enabled group
E365M\Domain Admins                             Group            S-1-5-21-3247909092-157580105-2477339510-512   Mandatory group, Enabled by default, Enabled group
E365M\Enterprise Admins                         Group            S-1-5-21-3247909092-157580105-2477339510-519   Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level            Label            S-1-16-12288

Notice the last two lines in group membership in the above output! This indicates membership of the Enterprise Admins group and credential elevation.

Ntdsutil Metadata Cleanup

Perform the following steps to clean up domain controller metadata from your domain

1. Enter the Ntdsutil interactive session by typing “ntdsutil”

2. Switch to the metadata cleanup context by typing “metadata cleanup”

3. Switch to the operation target selection context by typing “select operation target”

4. List your your domains and select your target domain

5. List your AD sites and select your target site

6. List your AD domain controllers and select your target domain controller

7. Exit the operation target selection context by typing “quit”

8. Request metadata cleanup of the selected server by typing “remove selected server”

9. Verify your request to complete the cleanup

The obsolete domain controller is now removed from both the domain and the configuration partition of your Active Directory. Make sure you don’t bring it online again.

Sample Output

To see some sample commands let’s try to remove metadata for the obsolete domain controller, “E365M-DC01”.

Depending on your setup the complete output from the above commands may look like this:

C:\Users\mskadm> ntdsutil
C:\Windows\system32\ntdsutil.exe: metadata cleanup
metadata cleanup: select operation target
select operation target: list domains
Found 1 domain(s)
0 - DC=Easy365Manager,DC=local
select operation target: select domain 0
No current site
Domain - DC=Easy365Manager,DC=local
No current server
No current Naming Context
select operation target: list sites
Found 2 site(s)
0 - CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local
1 - CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local
select operation target: select site 1
Site - CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local
Domain - DC=Easy365Manager,DC=local
No current server
No current Naming Context
select operation target: list servers in site
Found 2 server(s)
0 - CN=E365M-DC01,CN=Servers,CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local
1 - CN=E365M-DC02,CN=Servers,CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local
select operation target: select server 0
Site - CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local
Domain - DC=Easy365Manager,DC=local
Server - CN=E365M-DC01,CN=Servers,CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local
        DSA object - CN=NTDS Settings,CN=E365M-DC01,CN=Servers,CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local
        DNS host name - Easy365Manager-DC01.Easy365Manager.local
        Computer object - CN=E365M-DC01,OU=Domain Controllers,DC=Easy365Manager,DC=local
No current Naming Context
select operation target: quit
metadata cleanup: remove selected server
Transferring / Seizing FSMO roles off the selected server.
Removing FRS metadata for the selected server.
Searching for FRS members under "CN=E365M-DC01,OU=Domain Controllers,DC=Easy365Manager,DC=local".
Deleting subtree under "CN=E365M-DC01,OU=Domain Controllers,DC=Easy365Manager,DC=local".
The attempt to remove the FRS settings on CN=E365M-DC01,CN=Servers,CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local failed because "No mapping for error code.";
metadata cleanup is continuing.
"CN=E365M-DC01,CN=Servers,CN=DataCenter,CN=Sites,CN=Configuration,DC=Easy365Manager,DC=local" removed from server "\\E365M-DC03.Easy365Manager.local"
metadata cleanup: quit
C:\Windows\system32\ntdsutil.exe: quit
PS C:\Users\mskadm>

Conclusion

The above steps show you how to completely remove domain controller info from Active Directory.

It’s vital that you perform these steps if your domain controller crashed or was shut down without running dcpromo to safely remove the AD service.

The steps are not too hard but be careful running it on a production environment. Make sure you have a full backup of your AD (and know how to restore it) before making these changes.