Hope you like it..

DCPromo Fails – The directory service is missing mandatory configuration information

November 19, 2020 at 2:56 pm Leave a comment

Last week , we worked on a AD migration project. This project involved deploying a Windows 2016 based Domain Controller and then decommission the Windows 2008R2 domain controller.

We successfully transferred the FSMO roles . During the decommissioning process when we ran the dcpromo command we received the error “The directory service is missing mandatory configuration information”

During the troubleshooting the  MS KB (https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/dcpromo-demotion-fails) was pointing us to correct direction. The issue was related to  fsmoroleowner attribute  on CN=Infrastructure is not set properly. In my case it was pointing to the server which I am trying to demote.

You can see this by opening ADSI Edit;

Right click the ADSI Edit root and click on Connect to…
Use the following connection point: DC=DomainDNSZones,DC=abc,DC=local  (Replace it with your actual AD DNS Zone)
Click on Default Naming Context [DC.abc.local] to populate it.
Click on DC=DomainDNSZones,DC=abc,DC=local folder.
Double click on CN=Infrastructure.
Locate the fSMORoleOwner attribute

Ensure you connect to DC=ForestDNSZones as well to verify the attribute.

In my case DomainZones was showing the correct DC .But the ForestDNSZones pointing to the Windows 2008R2 Server.

I have tried the manual method using the ADSI Edit to change the value. However it was failing with the error  “The role owner attribute could not be read”

In this case you need to refer the MS KB https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/dcpromo-demotion-fails to create the .vbs file to fix this issue.( I have seen suggestions to run the dcpromo /forceremoval instead and then run a metadata cleanup. I do not recommend this approach)

The script provided in the KB does not work due to incorrect end statements. Luckily the Blogger veducate.co.uk (https://veducate.co.uk/dcpromo-fails-missing-mandatory-configuration/) have provided a fixed version.

NOTE: You need to  run these commands from the current owner of the FSMO roles.

Create a .vbs file via CMD
fsutil file createnew fixfsmo.vbs 0

Copy the below contents to the file
================================================

const ADS_NAME_INITTYPE_GC = 3
const ADS_NAME_TYPE_1779 = 1
const ADS_NAME_TYPE_CANONICAL = 2

set inArgs = WScript.Arguments

if (inArgs.Count = 1) then
‘ Assume the command line argument is the NDNC (in DN form) to use.
NdncDN = inArgs(0)
Else
Wscript.StdOut.Write “usage: cscript fixfsmo.vbs NdncDN”
End if

if (NdncDN <> “”) then

‘ Convert the DN form of the NDNC into DNS dotted form.
Set objTranslator = CreateObject(“NameTranslate”)
objTranslator.Init ADS_NAME_INITTYPE_GC, “”
objTranslator.Set ADS_NAME_TYPE_1779, NdncDN
strDomainDNS = objTranslator.Get(ADS_NAME_TYPE_CANONICAL)
strDomainDNS = Left(strDomainDNS, len(strDomainDNS)-1)

Wscript.Echo “DNS name: ” & strDomainDNS

‘ Find a domain controller that hosts this NDNC and that is online.
set objRootDSE = GetObject(“LDAP://” & strDomainDNS & “/RootDSE”)
strDnsHostName = objRootDSE.Get(“dnsHostName”)
strDsServiceName = objRootDSE.Get(“dsServiceName”)
Wscript.Echo “Using DC ” & strDnsHostName

‘ Get the current infrastructure fsmo.
strInfraDN = “CN=Infrastructure,” & NdncDN
set objInfra = GetObject(“LDAP://” & strInfraDN)
Wscript.Echo “infra fsmo is ” & objInfra.fsmoroleowner

‘ If the current fsmo holder is deleted, set the fsmo holder to this domain controller.

if (InStr(objInfra.fsmoroleowner, “\0ADEL:”) > 0) then

‘ Set the fsmo holder to this domain controller.
objInfra.Put “fSMORoleOwner”, strDsServiceName
objInfra.SetInfo

‘ Read the fsmo holder back.
set objInfra = GetObject(“LDAP://” & strInfraDN)
Wscript.Echo “infra fsmo changed to:” & objInfra.fsmoroleowner

End if

End if

=================================================

Run the file twice as below
1) cscript fixfsmo.vbs dc=forestdnszones,dc=abc,dc=local

2) cscript fixfsmo.vbs dc=domaindnszones,dc=abc,dc=local

Voila , The fsmoroleowner attribute got updated with the correct server name , and  I was able to demote the server successfully.

Source: (Helped me to fix the syntax errors on script provided by Microsoft)

DCPromo Fails – The directory service is missing mandatory configuration information

 

Thanks.

 

Entry filed under: Windows. Tags: dcpromo, fsmoroleowner.