Member Avatar for wyeknott

A Win7 Pro workstation was joined to a domain and the admins installed some Global Policies that block local administration.
It can no longer connect to the PDC and we want to disjoin the workstation from the domain.
Will the Global Policies from the PDC survive or not?
There are policies that prevent Windows Updates, etc, etc, and we need this workstation to revert to a local-only status.
Will those policies be removed if the PC is disjoined from the nominal domain?
Thanks...

  • 3 Contributors
  • 9 Replies
  • 349 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by wyeknott

Dani AI

Generated

Short answer: leaving the domain stops any further domain GPOs from applying, but it does not magically undo every change those GPOs already pushed to the machine. Some settings are enforced only while the machine is domain‑joined; others are written into the local registry or security databases and remain (this is the commonly called “tattooing” effect). (learn.microsoft.com)

Why that happens: Microsoft distinguishes true policy settings (written into the reserved Policies keys and removed when out of scope) from preference/registry writes that live elsewhere and persist. If a GPO used Preferences or custom ADM/ADMX that wrote outside the Policies branches, those registry values won’t be automatically removed when the PC leaves the domain. This explains the mixed answers in the thread from and . (learn.microsoft.com)

Practical checklist (safe order):

  • Capture what’s applied: export RSOP / gpresult so you can see GPO names and registry targets.
  • Ensure you have a working local administrator account or full backups before changing membership.
  • After you disjoin, inspect and remove tattooed settings; common clean steps are shown below. Use them only if comfortable and after backups.
gpresult /r
gpresult /h C:\Temp\GPO-report.html
rsop.msc

RD /S /Q "%WinDir%\System32\GroupPolicy"
RD /S /Q "%WinDir%\System32\GroupPolicyUsers"
gpupdate /force

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

Use LGPO.exe (Microsoft Security Compliance Toolkit) to export/import or reset local policy if you want a repeatable, supported workflow. These tools and the secedit approach are documented by Microsoft. (learn.microsoft.com)

If the workstation contains important software you cannot recreate easily, back up data and consider an image restore after cleaning; that is often faster and safer than hunting down every tattooed setting.

Recommended Answers

All 9 Replies

Member Avatar for rproffitt

I'm going with no. Example? "On the Password restrictions, it is enforced by the domain controller." so when you don't have the PDC, that restriction is lost. I'm sure there are more examples so you'll have to research each policy item to see if it sticks or not.

Member Avatar for rch1231

I would also have to say no. To remove it from the domain you are going to have to use a Domain Admin account and if you can't get to the domain controller then how are you going to remove it???

Member Avatar for wyeknott

I can simply disjoin it by converting it to a workgroup PC. It seems to me that in disjoining from the PDC, this would also sever all policies installed by that PDC but I'm not certain. If this isn't true, then it seems to me that a PDC could "poison" a workstation forever and that just doesn't make sense to me.
But disjoining is a point of no return so I don't want to make a bad situation worse.

Member Avatar for rproffitt

Again, we know that some policies are lost when there is no PDC so next up is your add on question about making a bad situation worse. It's just a PC so as you are the IT (yes or no?) you would be ready to wipe and start over with your new plan. There are tomes on the web about converting it to a Workgroup so I don't repeat that here. Your opening question looks answered.

What is this bad situation? It's unclear so far.

Member Avatar for wyeknott

IMHO, policies that prevent any part of local administration constitute a "bad situation". There are updates that are being blocked by policy and IMHO, that's bad. There's no backup for this workstation and reloading from scratch is a real time & money waster, assuming all the software discs are available -- that I don't know.
Thanks your advice.

Member Avatar for rproffitt

@OP, the IMHO reply tells us a lot more. Policies are done for reasons. With your IMHO reply I get an entirely different picture of your questions. At the onset I had thought you were the IT lead or part of the IT staff needing to find out what happens. Now it's sounding like someone that unplugged a workstation from a network and suffering the fallout.

Then you state no backup. That's very strange because in company after company they eventually learn that no backup is not tolerated if it's mission critical. Time to get back in those IT discussions and work to move this company back on track before they burn to the ground.

Member Avatar for wyeknott

"Policies are done for reasons." When a company is sold and the seller takes a workstation as part of the deal, he no-longer has access to the PDC and the "IT lead" is no-longer available.

I'm simply trying to make the best of a bad situation. Is the workstation "mission-critical"? No. But it does have numerous personal files that have already been backed up but there is no image of the workstation as far as I know.

I asked what I thought was a simple question:
"Would PDC originated policies survive a disjoin?"
It seems to me the PDC (domain, forest, etc) has no right to exercise policy controls on a PC that is not a member of the domain.
What I was hoping to hear was that a disjoin would remove all such policies.
If that's not so, then the disjoin wouldn't really accomplish much and I can forego it.

My motives shouldn't be the subject of speculation.
Thanks ever so much.

Member Avatar for rproffitt

Well that's clearer but as you discover, some may stick around. Now that more is known you still have, as a company an IT lead and your team to manage such a mess.

Sorry if I was unclear. Some of the policies are registry changes so you have to research each one and undo later. Some as the one I noted cease since it's something that only work when there is a PDC.

So change it to a workstation and deal with the mess as it is. Frankly the cost of the hours by your staff or IT is usually high enough that you just wipe and load your new standard load.

Member Avatar for wyeknott

Thanks. I suppose RSOP will be my main query tool after the disjoin.

commented: Yes, RSOP report after should be illuminating. +8
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.