Revision as of 08:19, 9 May 2013

Description

Leave an active directory domain by deconfiguring it locally.

Make sure you have other required software:
- realmd 0.14.0 or later
Verify that your Active Directory domain access works, or set a domain up.
Run through the test case to join the domain.
Verify that you are joined to the domain with the following command
```
$ realm list
```
Make sure you have a configured: kerberos-membership line in the output.

Note the login-formats: line.
Check that you can resolve domain accounts on the local computer.
Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
```
$ getent passwd 'AD\User'
```

Check that the domain is no longer configured.
```
$ realm list
```
Make sure the domain is not listed.
Check that you cannot resolve domain accounts on the local computer.
```
$ getent passwd 'AD\User'
```
There should be no output.
Check that there is no machine account for the domain in the keytab.
```
sudo klist -k
```
You should see no lines referring to the domain in the table, or an error message saying that the keytab does not exist.
If you have console access to a domain controller, you can use the Active Directory Users and Computers tool to see if that the computer account was not deleted.

Use the --verbose argument to see details of what's being done during a leave. Include verbose output in any bug reports.

$ realm leave --verbose ad.example.com

@@ Line 17: / Line 17: @@
 # Perform the leave command.
 #: <pre>$ realm leave ad.example.com</pre>
-#: You will be prompted for Policy Kit authorization.
+#: You will be prompted for Policy Kit authorization, because you're not running this as root.
 #: You will not be prompted for a password.
 #: This should proceed quickly, not take more that 10 seconds.
@@ Line 29: / Line 29: @@
 #: <pre>$ getent passwd 'AD\User'</pre>
 #: There should be no output.
-#: Use the <code>login-formats</code> you saw above, to build a remote user name. It will be in the form of <code>DOMAIN\User</code>, where DOMAIN is the first part of your full Active Directory domain name.
 # Check that there is no machine account for the domain in the keytab.
 #: <pre>sudo klist -k</pre>
 #: You should see no lines referring to the domain in the table, or an error message saying that the keytab does not exist.
-# If you have console access to a domain controller, you can use the ''Active Directory Users and Computers'' tool to see if that the computer account was not deleted.
+# If you have console access to a domain controller, you can use the ''Active Directory Users and Computers'' tool to see if that the computer account was '''not''' deleted.
 }}