When you demote a domain controller, the Directory Service and File Replication Service keys are NOT removed from the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog, causing the Event Viewer to still show these logs, even though they are no longer populated.

To resolve this issue, simply delete the Directory Service and File Replication Service sub-keys at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog.

NOTE: A restart is NOT required.

NOTE: You can use REG.EXE, built into Windows Server 2003, or REG.EXE from the Support Tools on the Windows 2000 Server CD-ROM, and type the following in a CMD.EXE window, pressing Enter after each line:

<b>REG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Directory Service" /F</b>
<b>REG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\File Replication Service" /F</b>