AD METADATA CLEANUP PRO
The complete toolkit for removing a failed Domain Controller and keeping Active Directory healthy
- Signed Windows installer
- Unique license key
- Instant email delivery
- Free updates
- Runs on DC or RSAT workstation
- Email support
When a Domain Controller dies and can't be demoted cleanly, its remnants linger in Active Directory — computer objects, FSMO roles, Sites & Services entries, and DNS records — quietly breaking replication, authentication, and name resolution. AD Metadata Cleanup Pro removes a dead DC completely, seizes or gracefully transfers its FSMO roles, cleans up DNS and Sites, fixes domain time, and then validates the whole domain's health — all from one console, with a backup safety-net before anything irreversible happens.
FAILED-DC REMOVAL
Removes a dead DC everywhere it hides — the computer object (Domain Controllers OU + Computers), the Sites & Services server and NTDS Settings, and its DNS records. Discovers live, partial, orphan, and ghost DCs from five sources.
FSMO SEIZE & TRANSFER
Seize operation-master roles from a dead DC, or gracefully transfer them between healthy DCs. Auto-detects current holders, previews the exact command, and refreshes after.
FULL HEALTH SUITE
One-click Run All Health Checks: replication (repadmin), SYSVOL / DFSR, AD services per DC, time skew, SPNs, and lingering objects — all rolled into a single color-coded audit report.
DNS & _MSDCS CLEANUP
Removes the stale A, CNAME, SRV, and delegation NS records that point at the removed DC — in both the forward zone and the _msdcs zone.
TIME / NTP CONFIG
Sets the PDC Emulator to external NTP and other DCs to the domain hierarchy, sets the time zone, and repairs a stuck Windows Time service — per DC, local or remote.
BACKUP PRE-FLIGHT
Before any irreversible step, it verifies a recent System State backup exists (and offers to install Windows Server Backup) — so you never seize or remove without a safety net.
REQUIREMENTS
- Run as Domain Admin or Enterprise Admin (elevated / UAC)
- ActiveDirectory and DnsServer PowerShell modules
- Best run directly on a healthy surviving DC, or a workstation with full RSAT
- WinRM enabled on remote DCs for multi-DC operations
SUPPORTED WINDOWS
- Fully tested: Windows Server 2016, 2019, 2022, 2025
- Supported (caveats): Server 2012 / 2012 R2 with WMF 5.1 installed
- Workstation: Windows 10 (1809+) / 11 with AD & DNS RSAT tools
BUILT TO BE SAFE
- Every destructive step is checkbox-gated and requires an explicit confirmation before it runs
- A backup pre-flight gate warns you before the first irreversible action if no recent System State backup is found
- Diagnostics and Preview are read-only; every operation is logged PASS/FAIL
- Important: once a role is seized, the failed DC must never be brought back online (USN rollback risk) — the tool reminds you at each step
Published by KW Tech Solutions LLC · digitally signed · EULA shown on launch