I have a group of machines in a multi-domain multi-site forest.

I am removing machines from Site-A/Domain-A and joining them to Site-B/Domain-B. Both domains span both sites and the inter-site replication is every ~15 mins (4 times per hour).

Domain A is 2003 functional, 4 * 2012R2 DCs. Domain B is the same and is a child domain of domain A (which in turn is the child of our root domain) in a forest of 6 domains with a 2003 functional forest level in 10 AD sites.

I am hitting issues where teh disabled computer accounts in Domain A are making it difficult to join the computers back to domain B. I quite rightly get told that the machine name in the domain wouldn't be unique.

Does anyone know a simple way of having the machine accounts delete out of the AD at the point of leaving the domain instead of disable?

I know i could write a Powershell script that does a for each forest, for each forest domain, for each forest domain dc - get computer, delete computer - but IF there was a precanned setting or option in AD that made this cleaner and took out the human "remember to run the script" factor - it would be awesome!



  • 1
    You can use scheduled tasks to eliminate the "human remember to run the script" factor... – Ryan Ries Feb 18 '15 at 18:32
  • 1
    Computer names only need to be unique within a domain. Computer names in domain A don't matter for domain B. – Greg Askew Feb 18 '15 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.