How to Remove DSfW Server in Child Domain and the Child Domain

This TID gives instructions on how to remove a DSfW Child Domain.

For removing a DSfW server, Domain, and Forest (removing DSfW from the eDirectory Tree) then follow TID 7005431.

To remove an ADC (Additional Domain Controller), only the DSfW objects directly related to the DSfW server need to be removed (ncp server, ldap, certificate objects, object in the Domain Controllers container, etc).

If the Domain Controller is functioning, please use the script in the Additional Information section that can be downloaded at dsfwdude.com.

Delete the following objects in the child domains.  If an object has child objects, delete the child objects first.

Builtin

Computers

DefaultMigrationContainer

Deleted Objects

ForeignSecurityPrincipals

Program Data

System

Users

Infrastructure

LostAndFound

NTDS Quotas

Domain Controllers container

OESSystemObjects 

On the container where the domain was mapped, remove the extentions domainDNS and xadFlags

DO NOT REMOVE PARTITION

Delete the following attributes on the container where the domain was mapped.

rIDManagerReference

TrustPosixOffset

wellKnownObjects

xad-Domain-Flag

In the parent domain in the cn=users container an object with the name of the child domain will exist.  It will have a $ at the end of the name of the object.  This object represents the trust set up between the parent and child domain.  Delete this object.

A new removal script, ndsdcrmx.pl, has been created for all versions including OES11 and OES11SP1 can also be downloaded at dsfwdude.com.  The ndsdcrmx.pl can be used on a ADC or PDC.  Warning, if used on a PDC it will remove the DSfW domain.  Transfer the FSMO roles before running on a PDC if there is an ADC and the DSfW domain is to be retained in the eDirectory tree.

There is a -f switch that can used in some partially configured situations, but it depending on how far the install has gone it may or may not work.

The new removal script also requires the manual removal of some trustee assignments if removing the DSfW Domain, not just the server.

Start with [This] trustees from the mapped container (usually the O)