How to Demote a Domain Controller Safely
Applies to: Windows Server 2019, 2022 and 2025.
A domain controller must be removed through supported demotion after roles, DNS dependencies, replication and client use are addressed.
Active Directory changes affect authentication across the environment. Use tested backups, separate privileged accounts and a maintenance plan. See networkmanager.info for managed Windows VPS services.
Prerequisites
- Confirm another healthy writable controller and DNS server.
- Transfer FSMO roles where required.
- Check replication and backups.
- Remove the address from client DNS configuration.
Procedure
Step 1: Review roles
Do not demote a required FSMO owner.
netdom query fsmo
Get-ADDomainController -Identity $env:COMPUTERNAMEStep 2: Validate health
Resolve failures first.
repadmin /replsummary
dcdiag /vStep 3: Review DNS dependencies
Check zones, delegations, forwarders and client references.
Step 4: Demote
Use the supported deployment cmdlet.
Uninstall-ADDSDomainControllerStep 5: Restart and inspect cleanup
Verify metadata, DNS and Sites and Services from another controller.
Verification
The former controller should be absent and forest health should remain good.
Get-ADDomainController -Filter *
repadmin /replsummary
dcdiag /eRollback and recovery
Correct reported issues and retry demotion. Forced removal and metadata cleanup are last-resort procedures.
Operational notes
Powering off and deleting a healthy controller is not a valid demotion.
Official references
Explore managed Windows Server hosting from Netcloud24 Canada.
