AD Metadata Cleanup Toolkit

AD metadata cleanup after DC decommission (runbook + checklist)

Download a one-click PowerShell runbook and a printable checklist to clean AD metadata after a DC decommission—DNS SRV/CNAME, KCC, DFSR, lingering objects, RODC.

PowerShell HTML Checklist DNS SRV/CNAME KCC / Repadmin

Updated: — Tested on: Windows Server 2022 Checksums: —

Text size:

Generate for my environment

Target DC (decommissioned)

Healthy DC (writable)

Domain (DNS name)

Forest root (DNS name)

DNS servers (comma separated)

Optional toggles

Seize FSMO RODC Fix lingering Dry-run mode

Completion: 0%

Almost done — get the Evidence Pack ZIP by email

No spam. Unsubscribe in one click. We only send updates when the runbook changes.

AD_Metadata_Cleanup_Runbook.ps1

<# 
  AD Metadata Cleanup — One-Click Runbook (Lite)
  Purpose : Safely remove all traces of a decommissioned DC and prove convergence.
  Requires: RSAT ActiveDirectory (required). DnsServer (optional). Run as Domain Admin.
  Usage   : .\AD_Metadata_Cleanup_Runbook.ps1 -TargetDC "DC-OLD01" -HealthyDC "DC-HUB01" -DnsServers "dns1","dns2" -SeizeFSMO -AutoYes
# Tested on: Windows Server 2019

[CmdletBinding(SupportsShouldProcess=$true)]
param(
  [Parameter(Mandatory=$true)][string]$TargetDC,
  [Parameter(Mandatory=$true)][string]$HealthyDC,
  [string]$Domain,
  [string]$Forest,
  [string[]]$DnsServers,
  [switch]$SeizeFSMO,
  [switch]$RODC,
  [switch]$FixLingering,
  [switch]$AutoYes
)

$ErrorActionPreference = 'Stop'

function Section($t){ Write-Host "`n=== $t ===" -ForegroundColor Cyan }
function Need-Admin {
  $p = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
  if(-not $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){ throw "Run in elevated PowerShell." }
}

Need-Admin
Import-Module ActiveDirectory -ErrorAction Stop
$dnsOK = $false
try { Import-Module DnsServer -ErrorAction Stop; $dnsOK=$true } catch { Write-Warning "DnsServer module not found (DNS deletion will emit manual hints)." }

# Context
$root=(Get-ADRootDSE)
if(-not $Domain){ $Domain=(Get-ADDomain).DNSRoot }
if(-not $Forest){ $Forest=(Get-ADForest).RootDomain }
$Evidence = Join-Path (Get-Location) ("_AD_Metadata_Cleanup_{0}" -f (Get-Date -Format "yyyyMMdd_HHmmss"))
New-Item -ItemType Directory -Path $Evidence | Out-Null
Start-Transcript -Path (Join-Path $Evidence "transcript.txt") | Out-Null

Section "Pre-flight health snapshot"
& repadmin /replsummary           | Tee-Object -FilePath (Join-Path $Evidence "replsummary-before.txt") | Out-Null
& repadmin /showrepl * /csv       | Out-File -FilePath (Join-Path $Evidence "repl-before.csv") -Encoding ascii
& dcdiag /e /c /v                 | Out-File -FilePath (Join-Path $Evidence "dcdiag-before.txt") -Encoding ascii

# Determine NTDS Settings GUID before deletion (for GUID CNAME cleanup)
$cfgNC=$root.configurationNamingContext
$ntds = Get-ADObject -LDAPFilter "(objectClass=nTDSDSA)" -SearchBase "CN=Sites,$cfgNC" -SearchScope Subtree -Properties objectGUID,distinguishedName |
        Where-Object { $_.DistinguishedName -like "*CN=$TargetDC,*" } | Select-Object -First 1
$NtdsGuid = $ntds.ObjectGUID.Guid

# FSMO rehome if needed
Section "FSMO review"
$dom = Get-ADDomain; $for = Get-ADForest
$held=@()
if($dom.PDCEmulator           -match "^$TargetDC(\.|$)") { $held+='PDCEmulator' }
if($dom.RIDMaster             -match "^$TargetDC(\.|$)") { $held+='RIDMaster' }
if($dom.InfrastructureMaster  -match "^$TargetDC(\.|$)") { $held+='InfrastructureMaster' }
if($for.SchemaMaster          -match "^$TargetDC(\.|$)") { $held+='SchemaMaster' }
if($for.DomainNamingMaster    -match "^$TargetDC(\.|$)") { $held+='DomainNamingMaster' }
if($held.Count -gt 0){
  Write-Host "$TargetDC holds: $($held -join ', ')" -ForegroundColor Yellow
  if($SeizeFSMO){ Move-ADDirectoryServerOperationMasterRole -Identity $HealthyDC -OperationMasterRole $held -Force -Confirm:(!$AutoYes) }
}else{ Write-Host "No FSMO roles on $TargetDC." -ForegroundColor Green }

# Directory metadata removal (ADSS order)
Section "Directory metadata removal"
# Remove NTDS Settings then Server object
$serverObj = Get-ADObject -LDAPFilter "(&(objectClass=server)(cn=$TargetDC))" -SearchBase "CN=Sites,$cfgNC" -SearchScope Subtree -ErrorAction SilentlyContinue
if($serverObj){
  $ntdsDN = (Get-ADObject -LDAPFilter "(objectClass=nTDSDSA)" -SearchBase $serverObj.DistinguishedName -SearchScope OneLevel -ErrorAction SilentlyContinue).DistinguishedName
  if($ntdsDN){ Remove-ADObject -Identity $ntdsDN -Confirm:(!$AutoYes) -ErrorAction SilentlyContinue; Write-Host "Removed NTDS Settings." }
  Remove-ADObject -Identity $serverObj.DistinguishedName -Confirm:(!$AutoYes) -ErrorAction SilentlyContinue; Write-Host "Removed Server object."
}else{ Write-Host "Server object already absent." }

# Remove DC computer object under OU=Domain Controllers if present
$dcOU=(Get-ADDomain).DomainControllersContainer
$comp = Get-ADComputer -LDAPFilter "(name=$TargetDC)" -SearchBase $dcOU -SearchScope OneLevel -ErrorAction SilentlyContinue
if($comp){ Remove-ADComputer -Identity $comp -Confirm:(!$AutoYes) -ErrorAction SilentlyContinue; Write-Host "Removed DC computer object." } else { Write-Host "DC computer object not found in OU=Domain Controllers." }

# DNS cleanup (SRV/CNAME/A)
Section "DNS cleanup"
$fqdn = "$TargetDC.$Domain"
$msdcs = "_msdcs.$Forest"
$dnsHosts = if($DnsServers){ $DnsServers } else { @($HealthyDC) }
if($dnsOK){
  foreach($server in $dnsHosts){
    Write-Host "DNS server: $server" -ForegroundColor Yellow
    # GUID CNAME
    if($NtdsGuid){
      $cn = Get-DnsServerResourceRecord -ComputerName $server -ZoneName $msdcs -Name $NtdsGuid -RRType CNAME -ErrorAction SilentlyContinue
      if($cn){ Remove-DnsServerResourceRecord -ComputerName $server -ZoneName $msdcs -InputObject $cn -Confirm:(!$AutoYes); Write-Host "Removed CNAME $NtdsGuid.$msdcs" }
    }
    # SRV records whose target equals $fqdn
    foreach($zone in @($Domain,$msdcs)){
      $srv = Get-DnsServerResourceRecord -ComputerName $server -ZoneName $zone -RRType SRV -ErrorAction SilentlyContinue | Where-Object { $_.RecordData.DomainName -ieq $fqdn }
      foreach($r in $srv){ Remove-DnsServerResourceRecord -ComputerName $server -ZoneName $zone -InputObject $r -Confirm:(!$AutoYes); Write-Host "Removed SRV $($r.HostName).$zone -> $fqdn" }
    }
    # A/AAAA host
    $hostLabel = ($fqdn -replace ("\.{0}$" -f [regex]::Escape($Domain)), '')
    foreach($t in 'A','AAAA'){
      $rr = Get-DnsServerResourceRecord -ComputerName $server -ZoneName $Domain -Name $hostLabel -RRType $t -ErrorAction SilentlyContinue
      foreach($r in $rr){ Remove-DnsServerResourceRecord -ComputerName $server -ZoneName $Domain -InputObject $r -Confirm:(!$AutoYes); Write-Host "Removed $t $hostLabel.$Domain" }
    }
  }
}else{
  Write-Warning "DnsServer module missing. Manual hints:"
  if($NtdsGuid){ Write-Host "  dnscmd <server> /RecordDelete $msdcs $NtdsGuid CNAME $fqdn /f" -ForegroundColor Magenta }
  Write-Host "  Remove SRV records targeting $fqdn in zones $Domain and $msdcs" -ForegroundColor Magenta
  Write-Host "  Remove host A/AAAA $fqdn in zone $Domain" -ForegroundColor Magenta
}

# Topology recompute and post health
Section "Topology recompute"
& repadmin /kcc * | Tee-Object -FilePath (Join-Path $Evidence "kcc.txt") | Out-Null
& repadmin /replsummary         | Tee-Object -FilePath (Join-Path $Evidence "replsummary-after.txt") | Out-Null
& repadmin /showrepl * /csv     | Out-File -FilePath (Join-Path $Evidence "repl-after.csv") -Encoding ascii
& nltest /dsgetdc:$Domain       | Tee-Object -FilePath (Join-Path $Evidence "nltest-dsgetdc.txt") | Out-Null
& nltest /dclist:$Domain        | Tee-Object -FilePath (Join-Path $Evidence "nltest-dclist.txt") | Out-Null
& dcdiag /e /c /v               | Out-File -FilePath (Join-Path $Evidence "dcdiag-final.txt") -Encoding ascii

# Lingering objects (optional)
Section "Lingering objects"
$src = Get-ADObject -LDAPFilter "(objectClass=nTDSDSA)" -SearchBase "CN=Sites,$cfgNC" -Properties objectGUID |
       Where-Object { $_.DistinguishedName -like "*CN=$HealthyDC,*" } | Select-Object -First 1
if($src){
  $srcGuid=$src.ObjectGUID.Guid
  $ncs=@($root.defaultNamingContext,$root.configurationNamingContext)
  if($root.schemaNamingContext){ $ncs += $root.schemaNamingContext }
  $mode = $FixLingering ? "" : "/advisory_mode"
  $all = (Get-ADDomainController -Filter *).HostName
  foreach($dc in $all){ foreach($nc in $ncs){ & repadmin /removelingeringobjects $dc $srcGuid $nc $mode 2>&1 | Tee-Object -FilePath (Join-Path $Evidence "lingering_$($dc.Split('.')[0]).txt") -Append | Out-Null } }
}else{ Write-Warning "Could not resolve reference DC GUID for lingering sweep." }

# RODC quick guidance
if($RODC){
  Section "RODC post-actions"
  Write-Host "Review PRP/cached secrets on surviving RODCs:" -ForegroundColor Yellow
  Write-Host "  repadmin /prp view <RODC> reveals" -ForegroundColor Yellow
  Write-Host "  repadmin /prp view <RODC> auth2"   -ForegroundColor Yellow
  Write-Host "If compromise suspected, follow two-stage KRBTGT reset guidance: https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b-reset-the-krbtgt-account-password" -ForegroundColor Yellow
}

Stop-Transcript | Out-Null
Write-Host "`nCompleted. Evidence folder: $Evidence" -ForegroundColor Green

Tip: Run in an elevated PowerShell session with RSAT. Use -AutoYes for non-interactive mode.

AD_Metadata_Cleanup_Checklist.html

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>AD Metadata Cleanup — Printable Checklist</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<style>
  :root{--ink:#0b1220;--muted:#4b5563;--accent:#0ea5e9;--ok:#10b981;--warn:#f59e0b;--bg:#ffffff;--border:#e5e7eb;}
  @media (prefers-color-scheme: dark) {
    :root{--ink:#e5e7eb;--muted:#9ca3af;--accent:#3b82f6;--bg:#1f2937;--border:#374151;}
  }
  *{box-sizing:border-box} html,body{margin:0;padding:0;background:var(--bg);color:var(--ink);font:15px/1.6 Inter,system-ui,-apple-system,Segoe UI,Roboto,Arial}
  .page{max-width:900px;margin:0 auto;padding:24px}
  header{border-bottom:2px solid var(--border);margin-bottom:16px;padding-bottom:10px}
  h1{font-size:24px;margin:0 0 6px;letter-spacing:-0.02em}
  .sub{color:var(--muted);font-size:14px}
  .meta{display:flex;gap:12px;flex-wrap:wrap;margin-top:10px}
  .chip{border:1px solid #d1fae5;background:#ecfdf5;color:#065f46;padding:4px 8px;border-radius:999px;font-weight:600;font-size:12px}
  .print{float:right;font-size:13px;color:#fff;background:var(--accent);border:none;padding:6px 10px;border-radius:6px;cursor:pointer}
  @media print {.print{display:none}}
  h2{font-size:18px;margin:18px 0 8px} h3{font-size:15px;margin:14px 0 6px}
  .block{border:1px solid var(--border);border-radius:12px;padding:14px;margin:12px 0}
  .row{display:grid;grid-template-columns:24px 1fr 160px;gap:8px;align-items:start;padding:6px 0;border-bottom:1px dashed #eef2f7}
  .row:last-child{border-bottom:none}
  input[type=checkbox]{width:18px;height:18px;margin-top:3px}
  .hint{color:var(--muted);font-size:12px}
  code{background:#f1f5f9;border:1px solid #e5e7eb;border-radius:5px;padding:1px 4px}
  @page{size:A4;margin:14mm}
  @media print{body{font-size:12px}.page{max-width:100%;padding:0}header{border:none;margin:0 0 6px;padding:0}.block{break-inside:avoid}}
</style>
</head>
<body>
<div class="page">
  <header>
    <button class="print" onclick="window.print()">Print</button>
    <h1>AD metadata cleanup — checklist</h1>
    <div class="sub">Use alongside the PowerShell runbook. Capture evidence as you go.</div>
    <div class="meta">
      <div class="chip">Metadata cleanup</div><div class="chip">DNS SRV/CNAME</div><div class="chip">KCC / Repadmin</div><div class="chip">Lingering objects</div>
    </div>
  </header>

  <div class="block">
    <h2>Context</h2>
    <div class="row"><input type="checkbox"><div>Target DC name:</div><div contenteditable="true" class="hint">e.g., DC-OLD01</div></div>
    <div class="row"><input type="checkbox"><div>Healthy DC (writable):</div><div contenteditable="true" class="hint">e.g., DC-HUB01</div></div>
    <div class="row"><input type="checkbox"><div>DNS servers to change:</div><div contenteditable="true" class="hint">dns1, dns2</div></div>
  </div>

  <div class="block">
    <h2>0) Pre-flight</h2>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Confirm <strong>FSMO holders</strong>; plan transfer/seizure if Target DC holds any.</div><div class="hint"><code>netdom query fsmo</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Capture baseline replication & diagnostics.</div><div class="hint"><code>repadmin /replsummary</code>, <code>dcdiag /e /c /v</code></div></div>
  </div>

  <div class="block">
    <h2>1) Remove server metadata (directory)</h2>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Delete <strong>NTDS Settings</strong> first, then the <strong>Server</strong> object (ADSS order).</div><div class="hint"><code>Remove-ADObject</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Remove DC <strong>computer object</strong> under OU=Domain Controllers if present.</div><div class="hint">ADUC/ADAC</div></div>
  </div>

  <div class="block">
    <h2>2) DNS cleanup</h2>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Delete per-DC <strong>GUID CNAME</strong> under <code>_msdcs.<forest></code>.</div><div class="hint"><code><GUID>._msdcs.<forest></code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Delete <strong>SRV</strong> records pointing to the old DC (global and site-scoped).</div><div class="hint"><code>_ldap._tcp.*</code>, <code>_kerberos._tcp.*</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Delete host <strong>A/AAAA</strong> for the DC.</div><div class="hint"><code>dcname.domain.tld</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Re-register DNS on surviving DCs; validate SRV/CNAME.</div><div class="hint"><code>ipconfig /registerdns</code>, <code>nslookup</code></div></div>
  </div>

  <div class="block">
    <h2>3) Recompute topology & verify</h2>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Force KCC recompute.</div><div class="hint"><code>repadmin /kcc *</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Ensure no edges to removed DC remain.</div><div class="hint"><code>repadmin /showrepl *</code></div></div>
  </div>

  <div class="block">
    <h2>4) SYSVOL replication (DFSR/FRS)</h2>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Confirm DFSR is in use and note global state.</div><div class="hint"><code>dfsrmig /getglobalstate</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Remove memberships/subscriptions referencing the old DC.</div><div class="hint"><code>Get-DfsrMembership</code></div></div>
  </div>

  <div class="block">
    <h2>5) Lingering objects</h2>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Run advisory lingering sweep.</div><div class="hint"><code>repadmin /removelingeringobjects ... /advisory_mode</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>If present & approved, remove without advisory mode.</div><div class="hint">Review logs</div></div>
  </div>

  <div class="block">
    <h2>6) RODC-specific (if applicable)</h2>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Review PRP and cached principals; assess risk.</div><div class="hint"><code>repadmin /prp view <RODC> reveals|auth2</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>If compromise suspected, plan two-stage KRBTGT reset with replication in between.</div><div class="hint">Microsoft KRBTGT guidance</div></div>
  </div>

  <div class="block">
    <h2>7) Final health proof</h2>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Verify DC locator and enumerate DCs.</div><div class="hint"><code>nltest /dsgetdc:domain</code>, <code>nltest /dclist:domain</code></div></div>
    <div class="row"><input type="checkbox" onchange="updateChecklistMeter()"><div>Run comprehensive diagnostics.</div><div class="hint"><code>dcdiag /e /c /v</code></div></div>
  </div>
</div>
</body>
</html>

Paste this HTML into a new page to print/share the checklist internally.

Companion: FSMO & hybrid placement Troubleshooting: Tombstones & LO RODC site design Subscribe: Runbook Friday

Copied!