0

Though quite skilled at software development, I'm a novice when it comes to Active Directory.

I've noticed that AD seems to have a lot of stuff buried in the directory and schema which does not appear superficially when using simplified tools such as Active Directory Users and Computers. It kind of feels like the Windows registry, where COM classes have all kinds of intertwined references, many of which are purely by GUID, such that it's not enough to just search for anything referencing "GadgetXyz" by name in order to cleanly remove GadgetXyz. This occasionally leads to the uneasy feeling that I may have useless garbage building up in there which I have no idea how to weed out.

For instance, I made the mistake a while back of trying to rename a DC, figuring I could just do it in the usual manner from Control Panel. I found references to the old name buried all over the place which made it impossible to reuse that name without considerable manual cleanup. Even long after I got it all working, I've stumbled upon the old name hidden away in LDAP. (There were no other DCs left in the picture at that time so I don't think it was a tombstone issue.)

More specifically, I'm worried about the case of just outright deleting a computer from AD. I understand the cleanest way to do it is to log into the computer itself and tell it to leave the domain. (As an aside, doing this in Windows 8 seems to only disable the computer object and not delete it outright!) My concern is cases where this is not possible, for instance because it was on an already-deleted VM image.

I can simply go into Active Directory Users and Computers, find the computer object, click it, and press Delete, and it seems to go away. My question is, is it totally, totally gone, or could this leave hanging references in any Active Directory nook or cranny I won't know to look in? (Excluding of course the expected tombstone records which expire after a set time.) If so, is there any good way to clean up the mess?

Thank you for any insight!

Kevin

ps.,

It was over a year ago so I don't remember the exact details, but here's the gist of the DC renaming issue. I started with a single 2008 DC named ABC in a physical machine and wanted to end up instead with a DC of the same name running in a vSphere VM. Not wanting to mess with imaging the physical machine, my plan instead was:

  1. Rename ABC to XYZ.

  2. Fresh install 2008 on a VM, name it ABC, and join it to the domain. (I may have done the latter in the same step as promoting to DC; I don't recall.)

  3. dcpromo the new ABC as a 2nd DC, including GC.

  4. Make sure the new ABC replicated correctly from XYZ and then transfer the FSMO roles from XYZ to it.

  5. Once everything was confirmed to work with the new ABC alone, demote XYZ, remove the AD role, and remove it from the domain.

Eventually I managed to do this but it was a much bumpier ride than expected.

In particular, I got errors trying to join the new ABC to the domain. These included "The pre-windows 2000 name is already in use" and "No mapping between account names and security IDs was done."

I eventually found that the computer object for XYZ had attributes that still referred to it as ABC. Among these were servicePrincipalName, msDS-AdditionalDnsHostName, and msDS-AdditionalSamAccountName. The latter I could not edit via Attribute Editor and instead had to run this against XYZ:

NETDOM computername <simple-name> /add:<FQDN>

There were some other hitches I don't remember exactly.

1 Answer 1

2

Even long after I got it all working, I've stumbled upon the old name hidden away in LDAP.

The rename of a domain controller is actually pretty good at getting objects and references renamed after a reboot, in my experience - can you be more specific about what objects you had problems with?

(As an aside, doing this in Windows 8 seems to only disable the computer object and not delete it outright!)

Removing a computer from the domain doesn't delete the computer object, only disables it - that behavior is not new in Windows 8.

My question is, is it totally, totally gone, or could this leave hanging references in any Active Directory nook or cranny I won't know to look in?

There's always a chance of some remnants of a computer being left in Active Directory after it's deleted, since the contents of Active Directory are by definition "whatever you put in it".

You'll need to consider what the system was doing, as well as your own definition of what's really "gone". DNS registrations can linger until scavenging, some services register or authorize with AD (DHCP, DNS, Cert Authority, Exchange), ACLs might still have entries for the object, and deleted domain controllers that aren't demoted cleanly need a metadata cleanup. No attempt is made to purge the computer from these kinds of references, nor should there be; the directory doesn't and shouldn't know how they function.

But, your concern seems to be that a simple computer object creates cruft all over the directory, which isn't the case; a computer object with nothing special going on will indeed be gone with that one delete operation.

1
  • +1 thank you for the info. Not worried about ACLs but hope the role-specific AD stuff disappears if the role is properly removed. I agree LDAP shouldn't itself consider semantics, but it'd be nice (tall order, I know) to have some tool that understands semantics of meta/data from all roles in order to do a thorough check/cleanup. As for the DC renaming issue, I've elaborated in the OP. Nov 14, 2012 at 2:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .