Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are closing one of our offices and I have to move a handful of workstations to our user's homes. Since AD is no longer reachable, I assume I have to dis-join them from the domain first? What will that do to the machine user profile?

Or can I leave it still connected as long as it will never present a problem, not sure.

The AD is Win 2003, DFL is 2003, FFL is 2003. Users are mainly Win7.

share|improve this question
Why do you plan to retire AD for this? Seriously - smell a lot more like I am clueless about how to run a Network, please explain me what VPN is".There is no reason to not ahve those machiens in the Domain. Use a VPN "ox" (mikrotik, cheap) or deploy DirectAcces. – TomTom Dec 3 '12 at 13:43

I you have cached credentials turned on they can continue to use them. If you set up a VPN, you can even have them participate on the corporate network.

share|improve this answer
Won't the cached credentials expire after a while? – Dan Dec 3 '12 at 12:57
They'll expire in AD, but locally cached credentials never expire, to my knowledge. – MDMarra Dec 3 '12 at 13:02

If you disjoin them from the domain first (which you don't have to, as mentioned by MDMarra), the user profile will not be affected - it doesn't get deleted. Of course, it will be inaccessible to normal users, and the old domain user won't be able to log onto it, so you'd normally copy all the documents and settings out to a local user's profile first.

And while it's possible to let these machines used cached credentials indefinitely, it's not a good idea. Much better to setup a simple VPN and have the users VPN in, which you can do fairly easily on a Windows server with an external IP address. See this Microsoft support KB for how to do so, because, again, this is really the much, much better approach than having them orphaned from the corporate network, whether they're domain-joined or not.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.