Child domain lost - How best to disconnect/disable mailboxes with no writable AD

%3CLINGO-SUB%20id%3D%22lingo-sub-130981%22%20slang%3D%22en-US%22%3EChild%20domain%20lost%20-%20How%20best%20to%20disconnect%2Fdisable%20mailboxes%20with%20no%20writable%20AD%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-130981%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20root%20AD%20forest%20has%20multiple%20sub%20domains%2C%20for%20example%20contoso.com%20is%20root%2C%20child%20domains%2C%20sub1.contoso.com%2C%20sub2.contoso.com%20etc.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EExchange%202016%20servers%20is%20installed%20into%20the%20root%20domain%2C%20contoso.com%20with%20prepearealldomains%2C%20so%20allows%20mailboxes%20to%20be%20associated%20AD%20user%20objects%20in%20the%20child%20domains.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThere%20was%20a%20issue%20encountered%20resulting%20in%20no%20writable%20DC%20for%20child%20domain%20sub1.contoso.com.%26nbsp%3B%20In%20addition%20the%20mailbox%20database%20which%20holds%20the%20mailboxes%20for%20these%20child%20domain%20is%20not%20recoverable.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAt%20the%20moment%2C%20the%20rest%20of%20Exchange%20is%20functioning%20okay.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20want%20to%20run%20Disable-Mailbox%2C%20Remove-Mailbox%20to%20delete%20mailbox%20for%20the%20sub1.contoso.com%20mailbox%20accounts%2C%20or%20run%20Set-Mailbox%20with%20a%20-ForwardingSMTPAddress%2C%20in%20order%20to%20route%20emails%20destined%20for%20the%20child%20domain%20users%20elsewhere.%26nbsp%3B%20Unfortunately%20each%20of%20these%20options%20require%20the%20ability%20to%20access%20the%20mailbox%20database%20in%20question%20or%20a%20child%20dc%20in%20sub1.contoso.com.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDoes%20anyone%20know%20how%20I%20can%20set%20the%20ForwardingSMTPAddress%20for%20these%20child%20user%20accounts%20mailboxes%2C%20or%20disable%2Fdisconnect%20the%20mailbox%20for%20these%20users%20in%20this%20scenario%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-130981%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2013%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3E2016%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2389540%22%20slang%3D%22en-US%22%3ERe%3A%20Child%20domain%20lost%20-%20How%20best%20to%20disconnect%2Fdisable%20mailboxes%20with%20no%20writable%20AD%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2389540%22%20slang%3D%22en-US%22%3EHey%20Ben%2C%20sorry%20to%20bring%20up%20past%20Exchange%20trauma%2C%20but....%20%3Ap%3C%2Fimg%3E%3CBR%20%2F%3EI'm%20in%20a%20similar%20situation...%20child%20domains%20are%20gone%20but%20the%20mailboxes%20and%20mailbox%20DBs%20still%20exist.%20Did%20you%20ever%20figure%20out%20what%20to%20do%3F%20I'd%20like%20to%20get%20these%20cleaned%20up.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2390209%22%20slang%3D%22en-US%22%3ERe%3A%20Child%20domain%20lost%20-%20How%20best%20to%20disconnect%2Fdisable%20mailboxes%20with%20no%20writable%20AD%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2390209%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1064196%22%20target%3D%22_blank%22%3E%40GregSmid%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFrom%20what%20I%20recall%20and%20checking%20old%20emails%2C%20I%20believe%20we%20attempted%20to%20disable-mailbox%20with%20various%20switched%20but%20that%20resulted%20in%20the%20same%20issue%20%2C%20e.g.%20being%20unable%20to%20contact%20the%20child%20domain%20controller%20(worth%20checking%20though).%20I%20don't%20think%20ADSI%20edit%20was%20an%20option%20for%20the%20user%20object%20wasn't%20accessible.%3CBR%20%2F%3E%3CBR%20%2F%3EIn%20this%20instance%2C%20I%20believe%20the%20child%20domain%20was%20not%20recoverable%2C%20so%20we%20took%20steps%20to%20remove%20the%20child%20domain%20controller%2Fs%20and%20child%20domain%20from%20the%20forest.%26nbsp%3B%20Taking%20this%20steps%20obviously%20has%20wider%20implications%20and%20depends%20on%20whether%20you're%20planning%20to%20recover%20your%20child%20domain%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20were%20to%20pursue%20removing%20the%20child%20domain%3B%20before%20doing%20this%2C%20I%20advise%20collected%20the%20mailbox%20details%20to%20an%20XML%20if%20you%20can%2C%20because%20you'll%20likely%20want%20to%20grab%20the%20lgeacyexchangedn%20and%20proxyaddresses%20to%20reapply%20elsewhere%20e.g.%20'Get-Mailbox%20-Identity%20john.smith%20%7C%20Export-clixml%20c%3A%5Ctemp%5Cjsmithmbxdetails.xml'%3CBR%20%2F%3E%3CBR%20%2F%3EAs%20a%20result%2C%20the%20mailboxes%20were%20then%20disconnected%20in%20Exchange%20and%20no%20longer%20associated%20to%20the%20orphaned%20AD%20objects.%26nbsp%3B%20I%20believe%20you%20could%20then%20connect%20the%20disconnected%20mailbox%20to%20another%20AD%20object.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20notes%20on%20the%20child%20domain%20controller%20and%20domain%20removal%20(obviously%20use%20at%20your%20own%20risk%20and%20I%20would%20recommend%20testing%20in%20a%20lab%20first%20if%20you're%20unsure%20first)....%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3ETo%20Remove%20Domain%20Controller%20%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3Entdsutil%3A%3C%2FP%3E%3CP%3Etype%20metadata%20cleanup%3C%2FP%3E%3CP%3Etype%20connections%3CBR%20%2F%3Econnect%20to%20server%20servernamehere%3C%2FP%3E%3CP%3EType%20quit%3C%2FP%3E%3CP%3Etype%20select%20operation%20target%3C%2FP%3E%3CP%3EType%20list%20domains%E2%80%AF%3C%2FP%3E%3CP%3EType%20select%20domain%20number%3C%2FP%3E%3CP%3EType%20list%20sites%3C%2FP%3E%3CP%3EType%20select%20site%20number%3C%2FP%3E%3CP%3EType%20list%20servers%20in%20site%3C%2FP%3E%3CP%3EType%20select%20server%20number%3C%2FP%3E%3CP%3EType%20quit%3C%2FP%3E%3CP%3EType%20remove%20selected%20server%3C%2FP%3E%3CP%3EType%20quit%3C%2FP%3E%3CP%3EIn%20Active%20Directory%20Users%20and%20Computers%2C%20expand%20the%20domain%20controllers%20container.%20Delete%20the%20computer%20object%20associated%20with%20the%20failed%20domain%20controller.%3C%2FP%3E%3CP%3EWindows%20Server%202003%20AD%20might%20display%20a%20new%20type%20of%20question%20window%2C%20asking%20you%20if%20you%20want%20to%20delete%20the%20server%20object%20without%20performing%20a%20DCPROMO%20operation%20.%20Select%20%E2%80%9CThis%20DC%20is%20permanently%20offline%E2%80%A6%E2%80%9D%20and%20click%20on%20the%20Delete%20button.%3C%2FP%3E%3CP%3EAD%20will%20display%20another%20confirmation%20window.%20If%20you%E2%80%99re%20sure%20that%20you%20want%20to%20delete%20the%20failed%20object%2C%20click%20Yes%20to%20remove%20the%20failed%20server%20object%20from%20DNS.%3C%2FP%3E%3CP%3EIn%20the%20DNS%20snap-in%2C%20expand%20the%20zone%20that%20is%20related%20to%20the%20domain%20from%20where%20the%20server%20has%20been%20removed.%20Remove%20the%20CNAME%20record%20in%20the%20_msdcs.root%20domain%20of%20forest%20zone%20in%20DNS.%20You%20should%20also%20delete%20the%20HOSTNAME%20and%20other%20DNS%20records.%20If%20you%20have%20reverse%20lookup%20zones%2C%20also%20remove%20the%20server%20from%20these%20zones.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3ETo%20remove%20domain%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3Entdsutil%3A%3C%2FP%3E%3CP%3Etype%20metadata%20cleanup%3C%2FP%3E%3CP%3Etype%20connections%3CBR%20%2F%3Econnect%20to%20server%20servernamehere%3C%2FP%3E%3CP%3EType%20quit%3C%2FP%3E%3CP%3Etype%20select%20operation%20target%3C%2FP%3E%3CP%3EType%20list%20domains%E2%80%AF%3C%2FP%3E%3CP%3EType%20select%20domain%20number%3C%2FP%3E%3CP%3EType%20quit%3C%2FP%3E%3CP%3EType%E2%80%AFremove%20selected%20domain%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

The root AD forest has multiple sub domains, for example contoso.com is root, child domains, sub1.contoso.com, sub2.contoso.com etc.

 

Exchange 2016 servers is installed into the root domain, contoso.com with prepearealldomains, so allows mailboxes to be associated AD user objects in the child domains.

 

There was a issue encountered resulting in no writable DC for child domain sub1.contoso.com.  In addition the mailbox database which holds the mailboxes for these child domain is not recoverable.

 

At the moment, the rest of Exchange is functioning okay.

 

I want to run Disable-Mailbox, Remove-Mailbox to delete mailbox for the sub1.contoso.com mailbox accounts, or run Set-Mailbox with a -ForwardingSMTPAddress, in order to route emails destined for the child domain users elsewhere.  Unfortunately each of these options require the ability to access the mailbox database in question or a child dc in sub1.contoso.com.

 

Does anyone know how I can set the ForwardingSMTPAddress for these child user accounts mailboxes, or disable/disconnect the mailbox for these users in this scenario?

3 Replies
Hey Ben, sorry to bring up past Exchange trauma, but.... :p
I'm in a similar situation... child domains are gone but the mailboxes and mailbox DBs still exist. Did you ever figure out what to do? I'd like to get these cleaned up.

@GregSmid 

 

From what I recall and checking old emails, I believe we attempted to disable-mailbox with various switched but that resulted in the same issue , e.g. being unable to contact the child domain controller (worth checking though). I don't think ADSI edit was an option for the user object wasn't accessible.

In this instance, I believe the child domain was not recoverable, so we took steps to remove the child domain controller/s and child domain from the forest.  Taking this steps obviously has wider implications and depends on whether you're planning to recover your child domain?

 

If you were to pursue removing the child domain; before doing this, I advise collected the mailbox details to an XML if you can, because you'll likely want to grab the lgeacyexchangedn and proxyaddresses to reapply elsewhere e.g. 'Get-Mailbox -Identity john.smith | Export-clixml c:\temp\jsmithmbxdetails.xml'

As a result, the mailboxes were then disconnected in Exchange and no longer associated to the orphaned AD objects.  I believe you could then connect the disconnected mailbox to another AD object.

 

My notes on the child domain controller and domain removal (obviously use at your own risk and I would recommend testing in a lab first if you're unsure first)....

To Remove Domain Controller

ntdsutil:

type metadata cleanup

type connections
connect to server servernamehere

Type quit

type select operation target

Type list domains 

Type select domain number

Type list sites

Type select site number

Type list servers in site

Type select server number

Type quit

Type remove selected server

Type quit

In Active Directory Users and Computers, expand the domain controllers container. Delete the computer object associated with the failed domain controller.

Windows Server 2003 AD might display a new type of question window, asking you if you want to delete the server object without performing a DCPROMO operation . Select “This DC is permanently offline…” and click on the Delete button.

AD will display another confirmation window. If you’re sure that you want to delete the failed object, click Yes to remove the failed server object from DNS.

In the DNS snap-in, expand the zone that is related to the domain from where the server has been removed. Remove the CNAME record in the _msdcs.root domain of forest zone in DNS. You should also delete the HOSTNAME and other DNS records. If you have reverse lookup zones, also remove the server from these zones.

To remove domain:

ntdsutil:

type metadata cleanup

type connections
connect to server servernamehere

Type quit

type select operation target

Type list domains 

Type select domain number

Type quit

Type remove selected domain



@Ben OwensOh wow, that is so much more detail than I was expecting or even hoping for... thank you!!

 

In our case, the child DCs are gone legitimately, just apparently not cleaned up properly. Even the parent domain is legacy and probably not long for this world, so I might just wait until it's time to turf the whole thing.

 

Definitely appreciate you taking the time to go back and look up your notes from three years ago though. If I could buy you a beer, I would!