Due to some mistakes, I have a lot of machines that seem to be bound to Active Directory (AD) from their side, but not from the side of the AD. The machines thinks they are still in the AD, but the AD disagrees.
This results in the well known "The trust relationship between this workstation and the primary domain failed" error when trying to log on.
I would like to either remotely/programmatically reset the ComputerMachinePassword or remotely/programmatically take them out of the AD and then join them to the AD again. But I can't even have them leave the AD by any command. I did try a lot of approaches, ranging from PowerShell over WMIC up to netdom, usually always getting a "permission denied" error. I have tried with both the domain admin and the local admin (and combinations), remotely and on the machine itself.
I can, however, remove the machine via the GUI. I'd prefer not to do this with around 100 computers though ;)
The problem seems to be that the machine itself wants to see AD admin permissions for it to be removed, which I can't get (as the AD will not give it (anymore)).
Is there any way to remove the machines from AD (or make then not AD-bound anymore) by command line, when they are in this state?