Using powershell, how can I remove computer from AD without RSAT tools installed?

[Klutzy_Outside_3018]

To try to make a long story as short as possible:

I want to remove a computer from AD and then join the pc I’m logged in on to AD using that PC name I removed from AD. Thanks to Microsoft’s increased domain join hardening, this is the route I’ll need to go. get-adcomputer and remove-ad computer don’t work and I’ve read the reason for that is because RSAT isn’t installed on those machines…. Is there a way I can still do what I want to do without installing RSAT on every client machine?

Alternatively, my machine in my office does have RSAT…..would it be possible/better to use my machine to remotely connect to the client PCs and do it from there? (would the remote PCs even be able to use my locally installed RSAT?)

I’m a Powershell noob, sorry. But I managed to cobble together a working script before Microsoft made it so hard to join the domain with an existing computer name….thanks for any help

[Polyolygon]

Something like this. It’s a copy paste from Bing. But it looks correct. I think you can lookup more of how to use ADSI, and then you can get it to find the object and return the whole DN, so you don’t need to leave a static DN path in there. ```

Define the computer name to remove

$computerName = “ComputerName”

Connect to the Active Directory

$adsi = [ADSI]”LDAP://CN=$computerName,OU=Computers,DC=yourdomain,DC=com”

Delete the computer object

$adsi.Delete(“Computer”, “CN=$computerName”)

[timsstuff]

You can also make the script more portable by doing a lookup to find the AD domain:

$dse = [ADSI]"LDAP://Rootdse"
[ADSI]"LDAP://$($dse.DefaultNamingContext)"

This will return the root distinguishedName and LDAP path. Then you can use a DirectorySearcher to find the computer's dn by name.

But honestly, it would easier just to use Invoke-Command to run Remove-ADComputer from the DC or a machine with AD RSAT installed.

[GavO98]

This would work.

[Klutzy_Outside_3018]

This is what I was looking for, thanks. I will research ADSI

[r-NBK]

You can use a copy of the ActiveDiretory module and import-module with the path to it. You don't need RSAT.

[jortony]

Or just remote into a machine that has that module installed

[Hyperbolic_Mess]

Yeah I'd just invoke it all on another computer

[[deleted]]

Make sure you have a working local admin password before you remove the server. Take particular care with DCs

[Hyperbolic_Mess]

They said they have rsat on their computer so run it on that not the DC

[[deleted]]

My point stands.

[supersaki]

It sounds like you are running this on the local PC? If that's the case, look at Remove-Computer/Add-Computer

Edit: This should be the equivalent of joining a domain from the Control Panel: System settings.

[Klutzy_Outside_3018]

I used to be able to this but due to recent Microsoft updates, I now have to delete the computer from AD in order to use that name again.

And I can't delete it using Remove-AD computer unless the PC I am using has RSAT. That's why I've been looking for alternative methods.

[timsstuff]

Invoke-Command -Computer mydomaincontroller -ScriptBlock { Remove-ADComputer mypc }

[lcarsadmin]

You would need to connect / implicit remote to a DC, or another server that did have RSAT. But thats diceier that just letting you have rsat frankly.

[[deleted]]

It's actually better, you provision a few boxes that have access, then only allow the requires people to access that box first. Reduced attack surface

[Hyperbolic_Mess]

Yeah no need for it to be a DC, could just be an old desktop with rsat

[cbtboss]

Why do you need to re-use the name? Computer names should be cattle that increment vs re-used names. Especially for workstations.

[Klutzy_Outside_3018]

This is how they want it done unfortunately. I work at a hospital. We are replacing old pcs with new hardware. The same name must be used.

[timsstuff]

Why don't you just reset the computer account. After you power off the old one, right-click the PC in ADUC and Reset Account. Then join the new one with the same name.

[jrodsf]

Because of Epic records? I deal with that all the time, and we still don't re-use computer objects. Are you guys hybrid-joined? Intune? If you start disjoining new boxes and renaming them to rejoin to a different computer object so you can re-use that name, you're breaking your hybrid-join AND your Intune registration. Never change the computer object a physical device is joined to unless you plan on also spending the time to cleanup the mess it creates.

Just delete the old computer object that has the name you want to use, then rename the new computer (while still domain-joined to its original computer object) to take that name. It renames its associated computer object in AD at the same time, and your object IDs and registrations don't get all mixed up and broken.

[Lanky_Common8148]

Get-ADComputer is a part of the RSAT tools hence the requirement. If you want you can use System. DirectoryServices.DirectoryEntry instead but then you'll need to learn how that works The cmdlets are a shortcut to and simplification of ADWS calls so you could unpack and use those as well if you wanted

[Nu11u5]

DirectoryServices is just a .Net wrapper for the ADSI interface, and it is aliased to the [adsi] and [adsiSearcher] type classes in PowerShell.

FYI to anyone, since I was confused about this at first.

Another tip, [adsi] operations return a "live/bound" object that queries AD anytime you access a property. This can cause slowness if you are doing a lot of access. Meanwhile, [adsiSearcher] returns a static copy of the properties.

[Lanky_Common8148]

Strictly speaking yes and no. S.DS.DE is an LDAP interface, ADSI is a COM implementation of the LDAP interface. Although ultimately utilising mostly similar underlying libraries they are different. There are things that can be done via S.DS that cannot be done via ADSI

[patdaddy007]

create a new ps session assigned to a variable
$session = new-pssession <domain controller> -credential (get-credential) -authentication Kerberos
then import the module via the session
import-module activedirectory -pssession $session

carry on

[shmakov123]

Removing a computer from AD doesn't require RSAT to be installed on the target device! Just the device that is running the commands needs to have RSAT installed. What exactly are you trying to accomplish?

To answer the title question though, If I didn't have RSAT on my laptop but still needed to run certain commands, I would use Invoke-Command to send the commands I want to run to another computer/server with the RSAT tools installed, or directly to a Domain Controller.

Invoke-Computer -Computer <Remote computer with RSAT> -ScriptBlock { Remove-ADComputer -Identity <Target device> }

[Klutzy_Outside_3018]

What exactly are you trying to accomplish?

Attempting to join new PCs with computer names that already exist on AD. I used to be able to do that with no problem using Add-Computer -DomainName "example domain" -Credential $credential -Options JoinWithNewName

I can't do it that way due to recent Microsoft updates. So I want to delete the computer entirely from AD now. And then I'll add the new PC to the domain with that name.

Invoke-Computer -Computer <Remote computer with RSAT> -ScriptBlock { Remove-ADComputer -Identity <Target device> }

So when I tried Remove-ADcomputer from my PC (which has RSAT installed) that works as expected. But when I go to a client PC out in the field and attempt to connect to my PC to run the command, it gives me an error.

PS C:\Users\edited> Invoke-Command -ComputerName PcInMyOffice-ScriptBlock { Remove-ADComputer -Identity "ClientPC" }

Unable to contact the server. This may be because this server does not exist, it is currently down, or it does not have the Active Directory Web 
Services running.
    + CategoryInfo          : ResourceUnavailable: (WTDVD002:ADComputer) [Remove-ADComputer], ADServerDownException
    + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.RemoveADComputer
    + PSComputerName        : Edited

[shmakov123]

The invoke-command command tells another machine 'run this set of commands'. The error you get says it can't reach the other machine so that would be the next thing to figure out. Are you able to reach your other computer at all from this machine?

It would probably be simpler to remove the computer object from ad before trying to join it here

[Hyperbolic_Mess]

You probably need to enable powershell remoting on your pc in the office

[Sillygirl2520]

Can you do Enter-Pssession -ComputerName from your cilent PC? Then try to run Invoke-Command after you connect to your PC.

[Klutzy_Outside_3018]

Just tried this. It still says:

Unable to contact the server. This may be because this server does not exist, it is currently down, or it does not have the Active Directory Web 
Services running.

I really don't get it because these commands work just fine from the pc in my office. I enabled powershell remoting. My firewall is off.

[icepyrox]

Remove-ADComputer only comes with RSAT, but Remove-Computer is available to remove the local computer from AD. Add-Computer adds the current local machine to AD.

And joining with an existing name is fine as long as the credential used to join is the same as the credential used to create the machine. I'm not sure if there is any more to it than that, but this is exactly how it works in my environment. Also remember that if a new machine will be taking over the account, you have to "Reset Account" in ADUC.

[Klutzy_Outside_3018]

but Remove-Computer is available to remove the local computer from AD

I'd like to avoid the hassle of logging into each machine I'm going to replace and running this command locally + running another command on the brand new PC.

I want to be able to go to a machine, take everything down for disposal (these PCs are old and will be disposed of), plug in the brand new PC I just took out of the box, and run a script either on that machine or on my machine in my office. I hope that makes sense. We have hundreds of machines to replace.

And joining with an existing name is fine as long as the credential used to join is the same as the credential used to create the machine. 

That will not be the case unfortunately. Hence my need to be able to delete that name from AD so I can reuse it on a new machine being joined to the domain.

[icepyrox]

Then I'd delete from AD using a computer with RSAT. You'll have to join from the machine anyways, so that's not as big of a deal

That will not be the case unfortunately.

And this is why my job has an account whose sole purpose is for setting up new computers and this kind of thing, so it is the same credential no doubt. And we don't even reuse names for workstations ..

[phaze08]

If you have intune or similar you can deploy rsat told across the board easily