How to unjoin Windows workstation from Active Directory safely?

Question

I have a Windows XP (SP2) laptop, which was originally used with an Active Directory network.

Now the laptop has been moved away from the corporate environemnt and is used as a standalone workstation without a LAN.

Is there an easy and safe procedure to "unjoin" a WinXP machine from the AD while keeping the user account and basic application settings intact?

Solution 1

Log on as a local administrator onto the machine and change the network settings so that it will no longer be part of the domain. Change it to a workgroup instead. On XP open up the network connections. Click the "Advanced" menu and select "Network Identification". You'll see that it is part of a domain. Click "Change" and set to a local workgroup name instead. The windows default is the workgroup name "WORKGROUP".

If you don't have admin rights, there are several linux based boot cd's that allow you to reset the administrator account on the local PC to a blank one.

Solution 2

Safest way in my books would be to start safe mode and log in with a different user. Take a complete copy of the user profile, c:\documents and settings\username... then go to system properties and leave the domain.

You can now restore the users documents and settings to wherever they need to be. I am not really sure of any easier way that is safe.

You may want to try the user migration tools (Windows Easy Transfer for XP), but I am unsure if this works on a domain.

Personally, if this was me, I would do the above backup first and then just reinstall from scratch. If it has been on a domain, it is likely that there may be settings left behind that can bite you in the a$$ later when you are wondering why something isn't working.

Comments

[Ciaran]

Probably better posted on www.serverfault.com

[Kelli]

Unfortunately, building a new account is not an option because of time constraints. The main reason for disassociating the XP box from the Active Directory is to make it boot up and otherwise work without unnecessary delays. The solution doesn't have to be an optimal "clean" AD unjoin, especially if it involves much work. Could I make the workstation just "skip" all the AD-related access delays with some lightweight techniques? I am open to semi-kludge suggestion like adding a static loopback (127.0.0.1) entry for the domain controller in the hosts file to prevent AD-related delays.

[hookenz]

I've downvoted this because it's not the normal way of going about it. It's also cumbersome and very slow. It's easy enough to clear the password with a linux password reset disk, logon as a local administraotr (not domain admin) and unjoin it. Solution proposed above and accepted.

[William Hilsum]

@Matt H - Thanks for the downvote, however, Your answer only deals with half the problem. It is easy to just unjoin, but he specifically asked on how to keep settings. If/when a machine unjoins from a domain, he will no longer be able to log in with this user. The reason I gave a "Cumbersome and very slow" answer was because he had a "combersome and complex" problem. Doing what I suggested is to backup all his settings.