After an IPA upgrade all of my 8 IPA servers are trust controllers. Before the upgrade only half of them were trust controllers. The other half were trust agents.

In my opinion not all of them have to be trust controllers. Is it safe to remove the controller role on 4 of the 8 servers? If yes, how would I do that without breaking anything?

Cheers, Ronald