4.3. Removing a RHEL system from an AD domain

Procedure

1. Remove a system from an identity domain using the realm leave command. The command removes the domain configuration from SSSD and the local system.

   # realm leave ad.example.com

   注意

   When a client leaves a domain, AD does not delete the account and only removes the local client configuration. To delete the AD account, run the command with the --remove option. Initially, an attempt is made to connect without credentials, but you are prompted for your user password if you do not have a valid Kerberos ticket. You must have rights to remove an account from Active Directory.

2. Use the -U option with the realm leave command to specify a different user to remove a system from an identity domain.

   By default, the realm leave command is executed as the default administrator. For AD, the administrator account is called Administrator. If a different user was used to join to the domain, it might be required to perform the removal as that user.

   # realm leave [ad.example.com] -U [AD.EXAMPLE.COM\user]'

   The command first attempts to connect without credentials, but it prompts for a password if required.