KB-3454: Steps to take when decommissioning a DC (domain controller)

Home >

KB-3454: Steps to take when decommissioning a DC (domain controller)

Product:

Centrify DirectControl , Centrify Identity Service, Mac Edition ,

Published:

12 April,16 at 11:13 AM

Rating:

Applies to: All versions of Centrify DirectControl

Question:

What needs to be done for Centrify adclient agent/servers that are currently bound to a domain controller (DC) that has been scheduled to be decommissioned?

The new DC will be on the same AD site.

Answer:

When a current DC is decommissioned and there are other DCs on the same site, the adclient should automatically failover to the next available DC.

The sequence is as follows:

Centrify's adclient selects a DC first by site and it knows the correct site to use by doing an LDAP ping to (any) DC.
It does a DNS SRV query for _ldap._tcp.<site>._sites.<domain> to get list of DCs to try first.
Then it loops through the list and probes the ports.
A DC that does not meet the port requirement, is considered not-eligible. (See KB-0029 for the list of required ports)
Adclient goes through each DC until it finds a good one.
If the site list is exhausted without finding any usable DCs, it does a DNS SRV query for _ldap._tcp.<domain>, i.e. Every known DC in the domain.
Adclient will try this list until it finds one to use within a reasonable response time.
If it cannot find any one to use, then it goes into Disconnected mode.

Run the following steps to verify a few things before decommissioning a DC:

Make sure adclient is talking to AD/DC, the 'CentrifyDC mode' should show connected
# adinfo
adcheck will show if there is more than one DC
# adcheck
Verify in /etc/centrifydc/centrifydc.conf file that there are no hard coded entries pointing to a particular DC
# grep -i dns.dc /etc/centrifydc/centrifydc.conf

If there is a hardcoded entry, remove it and save the file. Run "adreload" to reload the configuration file
# adreload
Check /var/centrifydc/kset.domaincontroller for any entries. This file should never be edited by hand, but it can be removed/renamed as Centrify will recreate the file during adjoin and populate it.