You uninstall Active Directory using the same techniques as you used to install it. You can run Configure Your Server and remove the Domain Controller (Active Directory) role, which in turn will start the Active Directory Installation Wizard, or you can simply type dcpromo at a command prompt to start the Active Directory Installation Wizard directly. When you uninstall Active Directory, you demote the domain controller and make it a member server in the domain. If you remove Active Directory from the last domain controller in the domain, the computer becomes a stand-alone server in a workgroup. You must be a member of the Domain Admins group to remove an additional domain controller in a domain, and a member of the Enterprise Admins group to remove the last domain controller from a domain.

Considerations for Removing Global Catalogs

If you run the Active Directory Installation Wizard on a domain controller that is also a global catalog server, you will see the warning prompt shown in the following screen:

This prompt appears because you don't want to remove the last global catalog from the domain accidentally. If you remove the last global catalog from the domain, users won't be able to log on to the domain. A quick way to check to determine the global catalog servers in a domain is to type the following command at a command prompt:

dsquery server -domain DomainName | dsget server -isgc -dnsname

where DomainName is the name of the domain you want to examine. Consider the following example:

dsquery server -domain cpandl.com | dsget server -isgc -dnsname

Here, you are examining the cpandl.com domain to obtain a list of the global catalog servers according to their DNS names. The output is shown in two columns, for example:

dnsname                isgc
corpsvr15.cpandl.com   no
corpsvr17.cpandl.com   yes

The first column is the DNS name of each domain controller in the domain. The second column is a flag that indicates whether the domain controller is also a global catalog. Thus, if the isgc value is set to yes for a domain controller, it is also a global catalog server.

When the wizard starts, click Next to display the Remove Active Directory page shown in Figure 36-9. If this is the last domain controller in the domain and you want to demote it, select This Server Is The Last Domain Controller In The Domain before you continue. After you remove the last domain controller in the domain, you will no longer be able to access any application partition data, domain accounts, or encrypted data. Therefore, before you uninstall the last domain controller in a domain, you should examine domain accounts and look for encrypted files and folders.

Figure 36-9. Removing Active Directory from a server.

When you are ready to continue, click Next. The Active Directory Installation Wizard shows you any default application data partitions that will be lost if you proceed, as shown in Figure 36-10. If the domain controller is also a DNS server, the DNS data in the ForestDnsZones and DomainDnsZones partitions will be removed. If the domain controller is the last DNS server in the domain, this will result in the last replica of the DNS information being removed from the domain. All associated DNS records will be lost and may need to be recreated.

Figure 36-10. Carefully check the application partitions that will be lost.

Click Next. Confirm that you really want to permanently delete the previously listed application partitions by selecting Delete All Application Directory Partitions On This Domain Controller, and then click Next again.

Next, you are prompted to type and confirm the password for the local Administrator account on the server, as shown in Figure 36-11. This is necessary because domain controllers don't have local accounts but member or stand-alone servers do, so this account will be recreated as part of the Active Directory removal process. To complete the Active Directory removal process, click Next, and then click Finish.

Figure 36-11. Set the local administrator password.

At this point, the actions the Active Directory Installation Wizard performs depend on whether you are removing an additional domain controller or removing the last domain controller from a domain. If you are removing an additional domain controller from a domain, the wizard does the following:

If you are removing the last domain controller from a domain, the wizard verifies that there are no child domains of the current domain before continuing. If child domains are found, removal of Active Directory fails with an error telling you that you cannot remove Active Directory. When the domain being removed is a child domain, the wizard notifies a domain controller in the parent domain that the child domain is being removed. For a parent domain in its own tree, a domain controller in the forest root domain is notified. Either way, the domain object is tombstoned, and this change is then replicated to other domain controllers. The domain object and any related trust objects are also removed from the forest. As part of removing Active Directory from the last domain controller in a domain, all domain accounts, all certificates, and all cryptographic keys are removed from the server. The wizard creates a local SAM account database and a local Administrator account. It then changes the computer account type to a stand-alone server and puts the server in a new workgroup.