One of the issues when decommissioning a domain controller is identifying any applications using that specific DC for LDAP authentication. Standard clients will use DNS records to find an alternate DC, but LDAP applications are typically configured with a static IP address or DNS name for authentication.
Identifying LDAP application authentication is difficult because both the applications and standard client authentication use LDAP. There is nothing in the event logs to differentiate them. The best option is to get clients to avoid using the DC for authentication. Then, all remaining traffic is LDAP applications that can be investigated.
There are two potential methods for pushing clients to use other DCs for authentication:
- Put the DC in it's own site.
- Change the priority of DNS records for the DC.
Clients prefer to use a domain controller in their own Active Directory site for authentication. If you create a new site specifically for the retiring DC, then clients should avoid it for authentication.
The DNS records that clients use to find DCs for authentication include a priority value. Clients attempt to contact DCs with a lower priority value first. The default priority value on the DNS records is 0 (zero). If you change the priority for the retiring DC, then all other DCs should be preferred and pretty much eliminate client authentication traffic.
You can manually change the priority on DNS records for the retiring DC, but there are quite a few and the DC may eventually change the priority back to 0. Instead set the LdapSrvPriority registry value that the DC will use to register it's own DNS records. The value does not exist by default and you will need to create it in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters.
You can also use GPO setting Priority Set in the domain controller locator DNS SRV Records for the Net Logon Service. If you use a GPO, then you'll need to use security filtering based on the computer object to have it apply only to the DC you want as it will be linked to the Domain Controllers OU.
Whichever method you use, clients might have cached information about sites or DNS records. It will take some time for the cached info to expire. This is not a get it done in 30 minutes activity.
Reference for LdapSrvPriority value: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/optimize-dc-location-global-catalog
When I initially looked at this issue, I thought that the registry value DnsAvoidRegisterRecords would filter out clients requests. However, this only prevents the DC from registering DNS records outside of the local site, thus preventing client authentication from non-local sites. As part of DC retirement, we need to discourage/disable client authentication in the local site as well. So, this is not effective.
