How to Demote a Domain Controller

Last Updated on August 7, 2025 by Arnav Sharma

Demoting a domain controller within an Active Directory infrastructure is a critical task that system administrators need to handle with care to maintain the integrity and performance of their networks. Whether you’re decommissioning old hardware, reorganizing your network, or simply reducing the number of servers, the process requires a detailed understanding and a methodical approach. This guide will walk you through the steps to demote a domain controller, both gracefully and by force, using tools like Server Manager and PowerShell on platforms ranging from Windows Server 2003 to Windows Server 2022.

Understanding the Role of a Domain Controller

Before diving into the demotion process, it’s essential to understand what a domain controller is. A domain controller (DC) is a server in your network that responds to security authentication requests within a Windows Server domain. It hosts the Active Directory Domain Services (AD DS), which manage all domain resources, including user accounts, rights management, and system security policies.

Preparing to Demote a Domain Controller

Before proceeding with the demotion of a domain controller (DC), certain preparatory steps are essential to ensure a smooth transition and to mitigate any potential disruptions to the Active Directory (AD) environment. These steps include verifying system roles, ensuring replication, backing up system states, and managing DNS and Global Catalog settings.

1. Verify System Roles: FSMO Roles Check

Flexible Single Master Operations (FSMO) roles are critical special authorities assigned to one or more domain controllers in your environment. Before demoting a DC, ensure that it does not hold any of these roles, or if it does, that they are properly transferred to another DC. Here’s how to proceed:

• Identify FSMO Role Holders: Use the command line or graphical tools to identify which DCs hold the FSMO roles. Here’s a PowerShell command to list all FSMO role holders:

Get-ADForest | Format-Table DomainNamingMaster, SchemaMaster
Get-ADDomain | Format-Table InfrastructureMaster, PDCEmulator, RIDMaster

• Transferring FSMO Roles: If the DC you are demoting holds any FSMO role, transfer it using the AD Users and Computers and the AD Sites and Services management consoles. Here are the steps for a typical transfer using the GUI:
  • AD Users and Computers: Right-click the domain node, choose “Operations Masters,” switch to the appropriate tab (RID, PDC, Infrastructure), and change the role holder.
  • AD Sites and Services: Navigate to the appropriate site and server, right-click the NTDS Settings object, choose “Operations Masters,” and transfer the roles for Domain Naming Master and Schema Master.

2. Ensure Replication

Proper replication among all DCs is crucial before demotion to prevent data loss. To check and ensure replication:

• Check Replication Status: Use the following PowerShell command to report any replication issues:

repadmin /replsummary

• Resolve Replication Issues: If there are any issues, resolve them before proceeding with the demotion. Ensure that the DC to be demoted is fully synchronized with the rest of the domain controllers to avoid any orphaned data.

3. Backup System States

Backing up the system state of the domain controller allows for a recovery option if the demotion fails or if unexpected results occur after the demotion. Here’s how to perform a system state backup:

• Using Windows Server Backup: Install the Windows Server Backup feature from the Server Manager (if not already installed) and use it to back up the system state:

wbadmin start systemstatebackup -backuptarget:E:

• Replace E: with the actual drive letter where you want to store the backup.

4. DNS and Global Catalog Checks

If the DC is also a DNS server or a Global Catalog (GC), these roles need consideration:

• Global Catalog: If your DC is a GC, ensure that other DCs in your domain are also GCs to handle the load and authentication requests post-demotion.
• DNS Role: Verify if the DC is integrated with your DNS. If so, update the DNS settings on client computers and other DCs to point to another operational DNS server.
  • Change DNS Server Settings on Client Machines: Update the DHCP scopes if DHCP is used, or manually change the preferred DNS server settings on static IP configurations.

By thoroughly preparing for the demotion of a domain controller through these detailed steps, you can ensure a more controlled and stable reduction in your Active Directory infrastructure, minimizing potential disruptions or data inconsistencies.

Demoting a Domain Controller Using Server Manager

Step-by-Step Process

1. Open Server Manager: On the domain controller you want to demote, open the Server Manager dashboard.
2. Navigate to Roles and Features: Use the Remove Roles and Features wizard to deselect the Active Directory Domain Services and DNS server roles if applicable.
3. Demotion Wizard: Follow the prompts to demote the server. You will need to specify whether this DC is the last domain controller in the domain. If not, ensure that another DC can take over the DNS and global catalog roles.
4. Administrator Credentials: Provide credentials that have administrative rights to demote the server.
5. DNS Delegation: Decide whether to remove DNS delegation if this server is a DNS server.
6. Confirm and Demote: Review your choices and click Demote. This step will start the removal of AD DS and convert the domain controller back to a member server.

Forcing a Demotion Using PowerShell

In situations where a standard demotion isn’t possible—such as network issues or server failure—you may need to force demote the domain controller.

Import-Module ActiveDirectory
$AdminCredential = Get-Credential  # Get administrator credentials
Remove-ADDomainController -Identity "DCName" -ForceRemoval -LocalAdministratorPassword (ConvertTo-SecureString -AsPlainText "NewAdminPassword" -Force) -Credential $AdminCredential

This command will forcefully remove the domain controller from the network and delete all AD DS roles, regardless of replication status or FSMO roles. It is essential to handle this process carefully as it can lead to potential data loss or network instability.

Post-Demotion Cleanup

After a domain controller has been demoted, perform the following cleanup tasks:

• Update DNS and DHCP configurations to ensure they point to the remaining domain controllers.
• Verify network functionality by checking that all client machines can locate domain resources and log in.
• Decommission or repurpose the server as needed, ensuring it no longer holds any significant network roles unless specifically required.