How can you forcibly remove AD from a server and what do you do later Can I get user passwords from the AD database?

Answer 1

dcpromo /forceremoval forcibly remove AD from a Server.

After you use the dcpromo /forceremoval command, all the remaining metadata for the demoted DC is not deleted on the surviving domain controllers, and therefore you must manually remove it by using the NTDSUTIL command.

Answer 2

Demote the server using dcpromo /forceremoval, then remove the metadata from Active directory using ndtsutil. There is no way to get user passwords from AD that I am aware of, but you should still be able to change them.

Another way out too

Restart the DC is DSRM mode

a. Locate the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions

b. In the right-pane, double-click ProductType.

c. Type ServerNT in the Value data box, and then click OK.

Restart the server in normal mode

its a member server now but AD entries are still there. Promote the server to a fake domain say ABC.com and then remove gracefully using DCpromo. Else after restart you can also use ntdsutil to do metadata as told in the earlier post

Answer 3

dcpromo is used to promote and demote Active Directory services. On Server 2008 you can remove the role (its easier).

When using dcpromo you may be asked if this is the last DC in a forest; if you remove that then the domain will be removed as well (you probably don't want to do that).

Answer 4

type dcpromo/forceremovel for removing ad from a server . Then one has to delete metadata of that DC as well with the help of NTDS utility

You cannot get user pasword from AD database because they are stored in encrypted format. there may be third party tool which can help.