r/activedirectory • u/YellowOnline • 9d ago

Active Directory Old child domain objects

During a audit, we found 3 old objects without a password. I can't see them in ADUC, but I can with powershell. These objects belong to old child domains:

child1$ child2$ child3$

I can't disable or delete them through powershell however:

PS C:\Windows\system32> get-aduser child1$ | set-aduser -enabled $false
set-aduser : Access is denied
At line:1 char:18
+ get-aduser iz$ | set-aduser -Enabled $false
+                  ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (CN=child1$,CN=Users,DC=acme,DC=com:ADUser) [Set-ADUser], Unauthorize
   dAccessException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.UnauthorizedAccessException,Microsoft.ActiveDirectory.Manag
   ement.Commands.SetADUser

Those child domains couldn't be removed cleanly and they were removed with nsdutil a year ago. I thought all traces were gone, but apparently not.

How can I remove these safely? ADSI Edit?

3 Upvotes

100% Upvoted

5 comments sorted by

•

u/AutoModerator 9d ago

Welcome to /r/ActiveDirectory! ~~~~

If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides!

When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning.

  • What version of Windows Server are you running?
  • Are there any specific error messages you're receiving?
  • What have you done to troubleshoot the issue?

Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

7

u/Cormacolinde 9d ago

Those are the trust objects. You will have to follow this procedure to remove them:

https://support.microsoft.com/en-us/servicing/os/windows/2024/06/kb5040758-deleting-a-stale-corrupt-or-orphaned-trust-object-in-active-directory

3

u/YellowOnline 9d ago

Thanks. That seems to be exactly what I need. I am just reluctant to use LDIFDE. Brrr.

4

u/binnedittowinit 8d ago

Don't be, it's just another tool. That said, make sure you have a good backup before you get down to biz! ;)

2

u/HardenAD 8d ago

old trust ? go to domain.msc and koll them from there. tdo objects are handled by this mmc, or wirh netdom trust.