Sunday, November 22, 2015

Removing the RODC computer account using the command line Server 2008

Although it requires a bit more typing, you can use the ntdsutil to remove the RODC computer account. To do so, complete the following steps:
  1. Open an elevated Command Prompt window on any Windows Server 2008 domain controller in the forest of the RODC that you want to remove. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

    If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. Type ntdsutil and press ENTER.
  3. Type metadata cleanup and press ENTER.
  4. Type connections and press ENTER.
  5. Type connect to domain <domainname> and press ENTER. Substitute the actual domain name to which you want to connect for <domainname>. For example, if you want to connect to a domain named hq.cpandl.com, you would type connect to domain hq.cpandl.com and press ENTER.
  6. Type connect to server <servername> and press ENTER. Substitute the actual server name for the server to which you want to connect. For example, if you want to connect to a domain controller named WS2008A in the hq.cpandl.com domain, you would type connect to server ws2008a.hq.cpandl.com and press ENTER.
  7. Type quit and press ENTER to the metadata cleanup prompt.
  8. Type select operation target and press ENTER.
  9. Type list domains and press ENTER. Note the sequential numbers that appear next to the domains that are listed. You must select the domain that contains the RODC account that you want to remove in the next step. To do so, you will need to know the number that represents that domain.
  10. Type select domain <number> and press ENTER. Substitute the actual number for the domain you want to select for <number>. For example, if the number assigned to the domain you want to select is 0, then type select domain 0 and press ENTER.
  11. Type list sites and press ENTER. Take note of the sequential numbers that appear next to the listed sites. You will need to select the site that contains the RODC account that you want to remove by the number assigned to that site in the next step.
  12. Type select site <number> and press ENTER. Substitute the number assigned to the site in which the RODC resides for <number>. For example, if the site where the RODC resides is numbered 5, then you would type select site 5 and press ENTER.
  13. Type list servers in site and press ENTER. Note the sequential number listed for the RODC account that you want to remove.
  14. Type select server <number> and press ENTER. Substitute the number listed for the RODC account you want to remove for <number>. For example, if the RODC you want to remove is listed as 1, you would type select server 1 and press ENTER.
  15. Type list naming contexts and press ENTER. Note the sequential numbers that appear next to the listed data partitions. You will select the domain naming context that contains the RODC account in the next step. This is the naming context that represents the domain from which you want to remove the RODC. For example, if you are trying to remove an RODC from the hq.cpandl.com domain, you would select the naming context that is listed as DC=hq,DC=cpandl,DC=com.
  16. Type select naming context <number> and press ENTER. Substitute the actual number assigned to the naming context that contains the RODC account you want to remove for <number>. For example, if you want to remove an RODC account from a naming context that is assigned number 3, then you would type select naming context 3 and press ENTER.
  17. Type quit and press ENTER to return to the metadata cleanup prompt.
  18. Type remove selected server and press ENTER.
  19. On the Server Remove Confirmation Dialog dialog box, review the information presented. Click Yes, if the RODC account you want to remove is specified in the dialog box. If not, click No, and perform the appropriate steps above to connect to the correct RODC account.
Once you have clicked Yes to remove the account, you should see confirmation of the removal in the ntdsutil application. You can type quit twice to exit the ntdsutil prompt and then type exit to close the Command Prompt Window.

No comments:

Post a Comment