I have a group of machines in a multi-domain multi-site forest.
I am removing machines from Site-A/Domain-A and joining them to Site-B/Domain-B. Both domains span both sites and the inter-site replication is every ~15 mins (4 times per hour).
Domain A is 2003 functional, 4 * 2012R2 DCs. Domain B is the same and is a child domain of domain A (which in turn is the child of our root domain) in a forest of 6 domains with a 2003 functional forest level in 10 AD sites.
I am hitting issues where teh disabled computer accounts in Domain A are making it difficult to join the computers back to domain B. I quite rightly get told that the machine name in the domain wouldn't be unique.
Does anyone know a simple way of having the machine accounts delete out of the AD at the point of leaving the domain instead of disable?
I know i could write a Powershell script that does a for each forest, for each forest domain, for each forest domain dc - get computer, delete computer - but IF there was a precanned setting or option in AD that made this cleaner and took out the human "remember to run the script" factor - it would be awesome!