How to Properly Decommission a Domain Controller (Server 2022/2025)

— powering it off and deleting the VM, for instance — leaves stale metadata in Active Directory that causes replication errors and orphaned references for months afterward. Here’s the clean way to do it on Server 2022 and 2025.

Before you start

Confirm this isn’t the last DC holding a FSMO role, and that it isn’t the last DC in the domain or forest (if it is, that’s a forest/domain removal, not a simple decommission — different process entirely). Check current FSMO role holders:

netdom query fsmo

If the DC you’re retiring holds any roles, transfer them first:

Move-ADDirectoryServerOperationMasterRole -Identity "NEW-DC-NAME" -OperationMasterRole SchemaMaster,RIDMaster,InfrastructureMaster,PDCEmulator,DomainNamingMaster

(Only include the roles this particular DC actually holds — check with netdom query fsmo first.)

Method 1: Uninstall the AD DS role via PowerShell (the clean, modern way)

From an elevated PowerShell session on the DC being retired:

Uninstall-ADDSDomainController -DemoteOperationMasterRole -RemoveApplicationPartitions

This demotes the server, removes AD DS, and cleans up metadata as part of the same operation. You’ll be prompted for a local administrator password for the server once it’s no longer a DC. It reboots automatically when finished.

Method 2: Server Manager GUI

1. In Server Manager, click the flag/notifications icon and choose Remove Roles and Features (or right-click the server > Remove Roles and Features).
2. On the roles page, untick Active Directory Domain Services — this triggers the demotion wizard automatically rather than just uninstalling the role blind.
3. Follow the wizard: confirm demotion, supply the new local admin password, and let it finish and reboot.

If the DC is already gone (forcibly removed, hardware died, VM deleted without demoting)

This is the scenario that actually causes the lingering metadata problems. Clean it up with a metadata cleanup from a *surviving* DC:

Get-ADDomainController -Filter *

Identify the orphaned DC’s distinguished name, then remove it:

Remove-ADObject -Identity "CN=OLD-DC-NAME,OU=Domain Controllers,DC=yourdomain,DC=com" -Recursive

You’ll also want to check DNS Manager and Sites and Services afterward for leftover references (NTDS Settings objects, SRV records) that a forced removal sometimes leaves behind even after the AD object itself is gone.

Verifying it’s clean afterward

repadmin /replsummary → dcdiag /v

Both should come back clean, with no references to the retired server. If repadmin still shows the old DC as a replication partner, the metadata cleanup didn’t fully catch everything — check Sites and Services manually for a leftover NTDS Settings object under the old server’s computer object.