Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have run into an issue with one of our machines which keeps the GPO settings after removal from the Domain. We must connect this machine to the domain to receive updates from our WSUS Server. After running the updates, we remove the machine from the domain and reboot. However, the GPO settings are sticking after removal which prevents the machine from functioning properly. This machine is located in a closed environment. Any ideas how to rid this machine of GPOs?

Running Windows 2008 R2

share|improve this question
Which settings? – mfinni Apr 4 '13 at 19:22
up vote 4 down vote accepted

You don't have to join a domain to use WSUS. Just point the client against WSUS (

And if you doubt - We are doing WSUS updates on standalone computers via MDT. Works like a charm.

share|improve this answer

This is intended behavior. Removing a GPO doesn't magically revert the settings made in the GPO.

The way I'd handle this to create a GPO with the settings you want to the machine to have once it's unjoined, apply that GPO to the machine, force a group policy update and then unjoin it from the domain.

Or just image the machine to a state before it's domain joined; both appraoches are pretty easy and low on effort.

The other, much suckier way of handling this is to hunt down the registry keys set by the GPOs and manually change them. This is time-consuming and dangerous, however, and I wouldn't do it unless I had a gun to my head.

Now, having said that, I'd just like to point out that I can't imagine a sane use-case for joining a machine to a domain just to get Windows Updates, and then unjoining it, so I'd say there's something very not right with that whole process, and you might be better suited fixing that mess than dealing with the GPOs, which is just a symptom of this silly procedure.

share|improve this answer
This isn't exactly true. If it's a setting under "Administrative Templates", the setting goes back to the default of "Not Configured" if the link is removed. You don't have to create an opposite GPO to set it back. – Kasius Apr 4 '13 at 20:06
Can't agree more, it is a ridiculous process but its mandated by others which, unfortunately, whom minds cannot be changed. I basically knew what I should do, go ahead and just have the machine update without joining the domain, there are a few settings we do wish for it to have to pass certain audits the management would have just been made easier but once we turn this over it will no longer be my issue. Just wanted some keen advice! Thanks! – JMeterX Apr 5 '13 at 0:16

The easiest thing to do is to move the object to a separate OU that has inheritance blocked. Then run a 'gpupdate /force'. And then remove it from the domain. Any setting that is under Administrative Templates (as well as many others, including Windows Settings\Security Settings) will go back to "Not Configured" after this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.