Removing a Failed or Dead Domain Controller from Active Directory (GUI & CLI Methods)
When a Domain Controller (DC) is powered off permanently, lost, or improperly demoted, Active Directory can keep stale references to it. These leftovers cause replication errors, DNS inconsistencies, and problems with FSMO transfers or new DC promotions. This guide covers both the GUI and command-line ways to clean it up.
Which Method to Use DC is still reachable → use Method 1: Server Manager below. This is Microsoft’s recommended graceful demotion path. DC is dead / unreachable, GUI available → use Method 2: ADUC below. DC is dead / unreachable, scripted or remote (no GUI) → use Method 3: PowerShell below. On Windows Server 2008 and later, Methods 2 and 3 both trigger metadata cleanup automatically — deleting the DC’s NTDS Settings object is what actually does it, whether that happens via ADUC’s wizard or a PowerShell cmdlet. The manual ntdsutil steps (Method 4) are only needed as a fallback — e.g., the object is already gone but stale references remain, or the automatic cleanup fails. DC is an RODC → see the note after Method 2; the removal flow and considerations differ. Warning: Only remove a DC’s metadata if it’s confirmed permanently gone. Running the manual cleanup steps against a DC that’s still alive (temporarily unreachable, network partition, etc.) will corrupt replication. Confirm FSMO roles have been transferred/seized and that you have a recent AD backup before proceeding with any of these methods.
