Summary
When the AD inspector queries Active Directory for user, computer, or group objects, they may fail with the error message “The server is not operational.” This typically occurs when a domain controller (DC) has been decommissioned improperly, leaving behind stale references in Active Directory or DNS that point to the removed DC.
Symptoms
Inspection logs display “The server is not operational” or similar errors when trying to retrieve AD objects.
AD queries suddenly fail after a domain controller has been removed from the environment.
Root Cause
If a domain controller was previously the main or only DC in the environment and it was not demoted correctly, references to it can remain in:
Active Directory Sites and Services (specifically under “Servers” and “NTDS Settings”)
DNS (stale SRV and A records)
AD metadata (replication objects referencing the old DC)
When AD queries attempt to discover an available domain controller, they may try to communicate with the removed DC and fail.
Resolution
Remove Stale References in Active Directory
Open Active Directory Users and Computers and ensure the removed domain controller does not appear under the domain’s “Domain Controllers” container.
In Active Directory Sites and Services, expand “Sites,” locate the old server under “Servers,” and remove it. If prompted for metadata cleanup, confirm to fully remove its references.
Delete the associated “NTDS Settings” object for that server if it remains.
Clean Up DNS Records
In your DNS management console, remove any stale entries (A or SRV records) that reference the decommissioned DC.
Verify zones such as
_msdcs.[your domain name]and[your domain name]for leftover records.
Verify Replication
Use tools like
repadmin(e.g.,repadmin /replsummary,repadmin /showrepl) to check for replication errors.Confirm that all remaining domain controllers replicate successfully and that none is referencing the decommissioned DC.
Ensure Proper DC Discovery
If possible, specify a valid domain controller or domain in your application or service configuration. This helps bypass stale references until your environment is fully cleaned up.
Once metadata cleanup is complete, AD queries should automatically locate the appropriate, operational domain controller.
Additional Recommendations
Monitor Logs: Keep an eye on event logs and application logs for any continued reference to the removed server.
Regular Maintenance: Periodically review AD Sites and Services, DNS zones, and replication health to ensure no stale data accumulates.
Related Articles & References
Microsoft Documentation on Metadata Cleanup (searchable on the Microsoft Docs site)
Microsoft Documentation on Removing a Domain Controller from a Domain (searchable on the Microsoft Docs site)
Disclaimer: Always ensure you have valid backups before making changes to Active Directory or DNS. If unsure, contact Microsoft Support or your AD administrator for assistance.