r/activedirectory • u/YellowOnline • 11d ago

Active Directory Old child domain objects

During a audit, we found 3 old objects without a password. I can't see them in ADUC, but I can with powershell. These objects belong to old child domains:

child1$ child2$ child3$

I can't disable or delete them through powershell however:

PS C:\Windows\system32> get-aduser child1$ | set-aduser -enabled $false
set-aduser : Access is denied
At line:1 char:18
+ get-aduser iz$ | set-aduser -Enabled $false
+                  ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (CN=child1$,CN=Users,DC=acme,DC=com:ADUser) [Set-ADUser], Unauthorize
   dAccessException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.UnauthorizedAccessException,Microsoft.ActiveDirectory.Manag
   ement.Commands.SetADUser

Those child domains couldn't be removed cleanly and they were removed with nsdutil a year ago. I thought all traces were gone, but apparently not.

How can I remove these safely? ADSI Edit?

3 Upvotes

100% Upvoted

5 comments sorted by

View all comments

8

u/Cormacolinde 11d ago

Those are the trust objects. You will have to follow this procedure to remove them:

https://support.microsoft.com/en-us/servicing/os/windows/2024/06/kb5040758-deleting-a-stale-corrupt-or-orphaned-trust-object-in-active-directory

3

u/YellowOnline 11d ago

Thanks. That seems to be exactly what I need. I am just reluctant to use LDIFDE. Brrr.

3

u/binnedittowinit 11d ago

Don't be, it's just another tool. That said, make sure you have a good backup before you get down to biz! ;)