JSI Tip 9694. When you demote a domain controller and join it as a member server, the Event Viewer still shows the Directory Service and File Replication Service Event logs?

When you demote a domain controller, the Directory Service and File Replication Service keys are NOT removed from the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog, causing the Event Viewer to still show these logs, even though they are no longer populated.

To resolve this issue, simply delete the Directory Service and File Replication Service sub-keys at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog.

NOTE: A restart is NOT required.

NOTE: You can use REG.EXE, built into Windows Server 2003, or REG.EXE from the Support Tools on the Windows 2000 Server CD-ROM, and type the following in a CMD.EXE window, pressing Enter after each line:

REG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Directory Service" /F
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\File Replication Service" /F