Search This Blog

Why it is recommended to never turn a DC back on after the role has been seized from it?

With the PDC Emulator and Infrastructure roles, this doesn't apply; they're able to recover just fine from a seizure. With the rest (RID, Schema, and Naming), it's not that you can't transfer back. It's that the recommendation is to never turn a DC back on after the role has been seized from it. The risk is that the two DCs both think they own the role; divergent schema changes, overlapping RIDs, and overlapping domains in the forest are the potential results.

How difficult it is to create these scenarios is another matter entirely (knowledge of the seizure will replicate to the old role holder and it will cease thinking it's the master - broken replication/connectivity is needed to create any risk); the recommendation to not bring the old DC back online is made due to an abundance of caution on Microsoft's part.

If you have to seize a RID, Naming, or Schema master's role, the safe course is to do metadata cleanup and reinstall the OS.