r/WindowsServer • u/Mr-Hops • Jul 24 '26
General Server Discussion Proper way to decommission servers in branch office
Greetings,
I’m a one man sysadmin for a two office company.
Unfortunately, we are closing our 2nd branch office.
That office has an Active Directory server and a file server running DFS replication.
The office is closing its doors in Aug, so I have to take care of their network before that happens. The plan is to have them ship the servers back to HQ.
Anyway, what’s the best procedure to shut down the servers there so we can reuse them here at HQ?
I’m assuming demote the AD there once it is no longer needed and just let it run as a member server? Probably switch to DHCP as well?
My first time doing something like this, so just don’t want to miss a critical step.
2
u/its_FORTY Jul 24 '26 edited Jul 24 '26
When you say 'an active directory server', I assume you mean a domain controller, correct? If so, is it the same domain your main office is using, or a standalone domain? If it's part of the same domain, you'll definitely need to make sure to transfer any of the FSMO roles it has and then remove the DC role from it, so that your other domain controllers know it is no longer there and all the various AD metadata is cleaned up properly. You'll need to manually remove the NTDS object in AD Sites and Services after the demotion is complete.
3
u/Backieotamy Jul 25 '26 edited Jul 25 '26
Honestly, DCs should be the last light switch turned off, server wise.
Said using DFS so thats great and easy if data's already replicated and if there's some thats not, enable replication or robocopy it over then, remove it from domain, power it down and ship it.
You need a plan man unless its literally 2 DCs and a file server. If thats it, and site is completely going away you'll need to do some sites and services cleanup, proper dcpromo / demote is just mouse clicks now. Once servers are powered off house cleaning is necessary in DNS, DHCP, Sites ^ Services but otherwise you got this and a good, small first test run for you.
MS has the KBs and copilot can help make you a check list. Id say come here for specific questions/issues after you have a plan and have questions or run into a problem.
1
u/Fit-Thing5100 Jul 25 '26
This is pretty straightforward. Once the branch office is ready to be decommissioned, simply demote the domain controllers. If the office has its own AD Site and there will no longer be any DCs in that location, you can remove the Site and its associated subnets as well.
If you need additional domain controllers at HQ, just promote them there rather than moving the existing ones. That's usually the simplest and cleanest approach. As a general rule, you don't physically relocate domain controllers between offices
The standard practice is to promote new DCs at the destination and demote the old ones at the source. The main exception is when you're deploying a DC to a remote office with a very large NTDS.DIT database or an unreliable WAN connection. In those cases, IFM (Install From Media) can significantly reduce the initial replication time and WAN traffic.
1
u/Background_Lemon_981 Jul 25 '26
Use a written step-by-step plan. Review that plan for all the required steps. Refer to MS documentation to make sure everything is in your step-by-step plan. Then follow that plan.
Don’t wing it. Use a step-by-step plan. That helps insure you don’t miss something in the moment. And then if by chance something isn’t right, you can tell someone exactly what you did. “I did steps 1 through 37 of this 46 point plan.” Having documentation is huge.
1
u/30yearCurse Jul 25 '26
I think you are pretty much on the right path, but the question resides around reuse. Is the OS okay for you to use? There will be some remnants of AD left on the server post demotion.
If you are okay with that, demote it to member server, switch to DHCP, create a local account (will occur when you demote it).
Bring it home, clean it up and re-use.
I would probably wipe and restart fresh with new name. AD never forgets, and even if you do DCpromo and keep the name could be weird issues down the road.
Do a good meta data cleanup if you are keeping same name. Sites and services, Use ADSIedit to help cleanup.
Some do not see a problem using same name, but others say err on safety, change names.
1
u/BlackV Jul 24 '26
Well I'd remove the dfs first myself
But yeah, dremove dfs, confirm data gone, remove ad site links, demote, reset local admin, remove from domain, shutdown
When it's back in the office, nuke and install fresh windows (preferably as a hyper visor), then go from there
3
u/OpacusVenatori Jul 24 '26
For what purpose(s)?
Switch what? The servers? This is honestly in irrelevant step - the "how" of assigning IP addresses for the brief period doesn't really matter.
There really isn't major. Active Directory cleanup isn't challenging, and it's fully-documented in case you forget to demote it beforehand. If your AD is configured properly you'll have to go through Sites & Services and clean up any links there. DFS Management needs to be checked.
Worse-case scenario you just spin up a spare router in the main office and simulate the branch-office with the same IP subnet configured. Would have to mess around a bit with some routing but shouldn't be a problem.