by lunarg on June 24th 2015, at 13:07

With dcpromo.exe now being deprecrated on 2012 and 2012 R2, it is no longer obvious which method to use to demote a domain controller. Although you could resort to Powershell to get it done, there's also a way to demote using Server Manager, albeit not a very clear one.

The trick is to attempt to remove the Active Directory Domain Services role from the server, using Server Manager. When you do remove this, you will be prompted to demote the domain controller before the role can be removed, along with a link to actually perform this task.

  1. Start Server Manager. In the upper right corner, click Manage, then click Remove Roles and Features.
  2. Continue in the wizard that appears, making sure the correct (current) server is selected.
  3. Deselect the role Active Directory Domain Services.
    On the dialog that appears, click the Remove Features button.
    After a while, another prompt will appear, stating that you have to demote the domain controller before the role can be removed:
  4. Clicking the link Demote this domain controller will start the Active Directory Domain Services Configuration Wizard. Proceed with following the steps of the wizard:
    1. On the Warnings page, check Proceed with removal.
    2. On the Removal Options, check or uncheck whether to remove DNS delegation. If you only have one domain, or are at a top-level domain in the forest, you usually uncheck this.
    3. Enter a new password for the local administrator account.
  5. On the last page, click the Demote button to demote the domain controller. The server will automatically reboot when the demote process is completed.

Demoting the server does not automatically remove the Active Directory Domain Services role. You still have to remove it by following steps 1 - 3 again. But when deselecting the role, it will no longer prompt you to demote the server first. When removing, you can optionally remove all management tools, which will remove all related tools, including GPMC.

The DNS Server will also still be installed, and you have to separately deselect that role if you wish to remove DNS as well.