You are the systems administrator for your company, which has a main office and four branch offices. The company’s network consists of a single Active Directory domain. Each office contains a domain controller.

The company is closing one of its four branch offices. You demote the domain controller located in that office. After the demotion process is complete, you discover that the NTDS Settings object was not removed correctly. You want to remove the remnants of the demoted domain controller from Active Directory.

Which utility should you use?

A.
Dcpromo.exe

B.
Dsamain.exe

C.
Ntdsutil.exe

D.
Dcdiag.exe

Explanation:
You should use the Ntdsutil.exe utility. Ntdsutil.exe provides management facilities for Active Directory. You can use Ntdsutil.exe to perform Active Directory database maintenance, manage and control single-master operations, and remove replication metadata left behind by domain controllers that are removed from the network by uninstalling Active Directory. The version of the Ntdsutil.exe utility included with Windows Server 2003 Service Pack 1 (SP1) or later performs the following tasks when metadata cleanup is run:

* Removes the NTDSA or NTDS Setting subject
* Removes inbound Active Directory connection objects that are used by existing destination domain controllers to replicate from the source domain controller that is being deleted
* Removes the computer account
* Removes File Replication service (FRS) member object
* Removes FRS subscriber objects
* Attempts to seize flexible single master operations (FSMO) roles held by the domain controller that is being removed

You should not use the Dcpromo.exe utility. Dcpromo.exe is an executable program that is used to promote and demote Windows 2000 Server, Windows Server 2003, and Windows Server 2008 domain controllers. The Dcpromo.exe utility cannot be used to remove remnants of domain controllers that are removed from the network.

You should not use the Dsamain.exe utility because this utility cannot be used to remove remnants of domain controllers that are removed from the network. The Dsamain.exe tool can be used to examine any changes that are made to data stored in Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS). The Dsamain.exe tool can improve recovery processes by providing a means to compare data as it exists in snapshots or backups taken at different times, allowing you to decide which data to restore after data loss.

You should not use the Dcdiag.exe utility because this utility cannot be used to remove remnants of domain controllers that are removed from the network. The DcDiag.exe tool analyzes the state of domain controllers in a forest and reports any problems to assist in troubleshooting.