Member Avatar for NZChris

I have a couple of machines that have a Netlogon error that can be corrected by removing it from and then reconnecting it to the Domain. I have already done this once and successfully resolved the problem. However, the side effect of this was that the profile of the user on the PC was blown away and I had to spend ages reconnecting him after the event.

I have heard rumours of a command line that can remove the pc from the domain without killing the profile but have been unable to find anything about it. Any hints as to a method (command line or otherwise) would be gratefully accepted.

regards
Chris

  • 2 Contributors
  • 2 Replies
  • 200 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by NZChris

Dani AI

Generated

Short answer: there is no single built-in switch that will unjoin a workstation and magically remap the domain user's profile to a new local account. As noted, there is a real difference between deleting or resetting the computer object in AD and simply disjoining; confirmed the machines were unjoined, which is why the domain SID-to-profile mapping was lost even though the profile folder remained on disk.

A much safer first step (and often the quickest fix) is to avoid unjoining entirely: reset the computer account in Active Directory (AD Users and Computers -> right‑click computer object -> Reset) and then reboot the client. That typically repairs the secure channel/Netlogon issues while leaving the profile intact.

If unjoining is unavoidable, the usual low‑risk procedure to preserve the profile is:

  1. Back up the profile folder (C:\Documents and Settings\<user> or C:\Users\<user>) and export the profile registry entry under
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
  2. Create a local account and log in once to create its profile, then log off.
  3. In the registry, locate the new local user SID under ProfileList and change its ProfileImagePath value to point to the old domain profile folder.
  4. Fix NTFS permissions: take ownership of the profile folder and grant the new local account Full Control (use the File Properties GUI or the appropriate command-line tool for the OS: icacls on Vista/Server2008+, cacls/subinacl on older systems).
  5. Log in as the local user and confirm settings/files. Restore the exported registry key only if rollback is needed.

Cautions: back up registry and data first. EFS-encrypted files, DPAPI/cached credentials and certificates tied to the domain account will not be usable by the local account unless the user’s private keys are exported beforehand. Test the procedure on one machine before applying broadly.

Member Avatar for zeebee

Probably you are talking about . This tool is used to remove objects (including computer object, here is ) from Active Directory. But what you do when you say you are removing the computer? Do you remove it from AD or just disjoin from the domain using the Indentification Changes dialog box? If you disjoin the computer from domain, you disable account and the object GUID remains in Active Directory but when you delete the object you delete GUID from the Active Directory what you can view using the ADSIEdit utility. Here's how you can delete computer account and using scripting.

Member Avatar for NZChris

I am just unjoining it from the Domain

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.