<div class="content" name="NetrUnjoinDomain3" uuid="cdf1f9bb-372c-4470-b60e-5df7bab891d9"><p>The <b>NetrUnjoinDomain3</b> method uses encrypted
credentials to unjoin a computer from a workgroup or <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_b0276eb2-4e65-4cf1-a718-e0920a614aca" data-linktype="relative-path">domain</a>.<a id="Appendix_A_Target_140"></a><a aria-label="Product behavior note 140" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_140" data-linktype="relative-path">&lt;140&gt;</a></p><dl>
<dd>
<div><pre> unsigned long NetrUnjoinDomain3(
   [in] handle_t RpcBindingHandle,
   [in, string, unique] wchar_t* ServerName,
   [in, string, unique] wchar_t* AccountName,
   [in, unique] PJOINPR_ENCRYPTED_USER_PASSWORD_AES Password,
   [in] unsigned long Options
 );
</pre></div>
</dd></dl><p><b>RpcBindingHandle:</b> An <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a> binding <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_5044babb-08e3-4bb9-bc12-fe8f542b05ee" data-linktype="relative-path">handle</a> (see <a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a>).</p><p><b>ServerName: </b>This parameter has no effect on
message processing in any environment. The client MUST set this parameter to a
value that resolves to the IP destination address of the RPC packets it
transmits (<a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a>
section <a href="../ms-rpce/7063c7bd-b48b-42e7-9154-3c2ec4113c0d" data-linktype="relative-path">2.1.1.2</a>).
The <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_434b0234-e970-4e8c-bdfa-e16a30d96703" data-linktype="relative-path">server (1)</a> MUST
ignore this parameter.</p><p><b>AccountName: </b>A pointer to a string that
specifies the account name in the joined domain to use when connecting to a <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">domain controller</a>. This
parameter is optional. If this parameter is NULL, the caller&#39;s account name
MUST be used.</p><p><b>Password: </b>An optional pointer to a <b>JOINPR_ENCRYPTED_USER_PASSWORD_AES</b>
structure (section <a href="b3b6d235-29e8-44ec-a723-8fb06a0799d8" data-linktype="relative-path">2.2.5.19</a>)
that specifies the encrypted password to use with the <i>AccountName</i>
parameter. If this parameter is NULL, the caller&#39;s <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_88d49f20-6c95-4b64-a52c-c3eca2fe5709" data-linktype="relative-path">security context</a> MUST be
used.</p><p><b>Options: </b>A 32-bit bitfield specifying modifications
to default message processing behavior.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value/code</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>NETSETUP_ACCT_DELETE 0x00000004</td>
  <td>Disables the account when the unjoin operation occurs.</td>
 </tr><tr>
  <td>NETSETUP_IGNORE_UNSUPPORTED_FLAGS 0x10000000</td>
  <td>The server ignores undefined flags when this bit is set.&lt;141&gt; This option is present to allow for the addition of future optional values.</td>
 </tr></tbody></table>
</dd></dl><p><b>Return Values: </b>When the message processing
result meets the description in column two of the following table, this method
MUST return one of the following values (<a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a>
section <a href="../ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d" data-linktype="relative-path">2.2</a>).</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value/code</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>NERR_Success 0x00000000</td>
  <td>The operation completed successfully.</td>
 </tr><tr>
  <td>ERROR_ACCESS_DENIED 0x00000005</td>
  <td>Access is denied.</td>
 </tr><tr>
  <td>ERROR_INVALID_PASSWORD 0x00000056</td>
  <td>The specified network password is not correct.</td>
 </tr><tr>
  <td>ERROR_INVALID_PARAMETER 0x00000057</td>
  <td>One of the function parameters is not valid.</td>
 </tr><tr>
  <td>ERROR_INVALID_FLAGS 0x000003EC</td>
  <td>Invalid option flags are specified.</td>
 </tr><tr>
  <td>RPC_S_PROTSEQ_NOT_SUPPORTED 0x000006A7</td>
  <td>The RPC protocol sequence is not supported.</td>
 </tr><tr>
  <td>NERR_SetupNotJoined 0x00000A84</td>
  <td>This computer is not currently joined to a domain.</td>
 </tr><tr>
  <td>NERR_SetupDomainController 0x00000A85</td>
  <td>This computer is a domain controller and cannot be unjoined from a domain.</td>
 </tr></tbody></table>
</dd>
<dd>
<p>Any other return value MUST
conform to the error code requirements in <b>Protocol Details</b> (section <a href="aeea622a-ea3e-40cc-a9b1-b4a2a3b2bf6b" data-linktype="relative-path">3</a>).</p>
</dd></dl><p>Unless otherwise noted, if the server encounters an error
during message processing, the server SHOULD revert any state changes made,
MUST stop message processing, and MUST return the error to the caller.<a id="Appendix_A_Target_142"></a><a aria-label="Product behavior note 142" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_142" data-linktype="relative-path">&lt;142&gt;</a></p><p>The following definitions are used in the specification of
message processing that follows.</p><ul><li><p><span><span> 
</span></span><i>DomainControllerString</i>: A UTF-8 string containing the name
of a domain controller in the domain to which the server is joined.</p>
</li><li><p><span><span> 
</span></span><i>DomainObject</i>: An object in the domain database (<a href="../ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a" data-linktype="relative-path">[MS-ADTS]</a>
section <a href="../ms-adts/e5dd47ea-3ff5-451c-b6fe-c3bda5591402" data-linktype="relative-path">6.4</a>)
having the value of <b>ComputerNameNetBIOS</b> (section <a href="e0b508bc-764d-48b7-b44b-4f93c3d5cf8c" data-linktype="relative-path">3.2.1.5</a>) suffixed with a
&#34;$&#34; character for the <b>SamAccountName</b> attribute.</p>
</li><li><p><span><span> 
</span></span><i>PasswordString</i>: A <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_409411c4-b4ed-4ab6-b0ee-6d7815f85a35" data-linktype="relative-path">UTF-8</a> string that contains
a password in <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_f6e0fdd0-cbc1-4c9d-93b8-f25125f9c5ef" data-linktype="relative-path">cleartext</a>.</p>
</li></ul><p>The following statements define the sequence of message
processing operations.</p><ol><li><p><span>    </span>The server MUST
retrieve the RPC protocol sequence used for the current call ([MS-RPCE] section
<a href="../ms-rpce/0ceefe4c-0d7a-423f-bcd0-54e821767f89" data-linktype="relative-path">3.1.3.4.1</a>),
specifying the server binding handle maintained by the RPC runtime ([C706]
section 6.2.1). If that RPC protocol sequence is not <b>NCACN_NP</b>, the
server SHOULD return <b>RPC_S_PROTSEQ_NOT_SUPPORTED</b>.<a id="Appendix_A_Target_143"></a><a aria-label="Product behavior note 143" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_143" data-linktype="relative-path">&lt;143&gt;</a></p>
</li><li><p><span>    </span>The server MUST
check that the caller has been granted access rights using the algorithm in the
<b>Access Control Abstract Data Model</b> (section <a href="c5b75090-3de2-404f-8de1-d5ca3fc38a70" data-linktype="relative-path">3.2.1.1</a>), with <i>Access
Request mask</i> initialized to <b>WKSTA_NETAPI_CHANGE_CONFIG</b>; if not, the
server MUST return ERROR_ACCESS_DENIED.</p>
</li><li><p><span>    </span>If <i>Password</i>
is NULL, <i>PasswordString</i> MUST be NULL. Otherwise, the server MUST decrypt
and decode the <i>Password</i> (section 2.2.5.19). <i>PasswordString</i> MUST
equal the decrypted and decoded value. The decrypted buffer is represented as a
<b>JOINPR_USER_PASSWORD</b> structure (section <a href="6320ca78-6492-4eaf-ad95-a558ad399383" data-linktype="relative-path">2.2.5.17</a>). The value of
the <b>Length</b> member MUST be less than 513; otherwise, message processing
is stopped, and the server MUST return ERROR_INVALID_PASSWORD.</p>
</li><li><p><span>    </span>The server MUST
impersonate the client by invoking the <b>StartImpersonatingClient</b> task
(section <a href="719ae534-d5d7-4c42-9989-d63e0676fad1" data-linktype="relative-path">3.2.4.29.6</a>).
If this operation fails, the server MUST return an error.</p>
</li><li><p><span>    </span>The server MUST
stop message processing and return NERR_SetupNotJoined if <b>DomainSid</b>
(section <a href="9a3b66f6-367f-4b88-b17d-1f9b6115ed21" data-linktype="relative-path">3.2.1.6</a>) is
NULL.</p>
</li><li><p><span>    </span>If any bits
other than NETSETUP_ACCT_DELETE are set in <i>Options</i>, the server MUST
check the NETSETUP_IGNORE_UNSUPPORTED_FLAGS bit. If it is not set, the server
MUST stop message processing and return ERROR_INVALID_FLAGS. Otherwise, message
processing continues.</p>
</li><li><p><span>    </span>The server MUST
stop message processing and return NERR_SetupDomainController if the server
processing the message is a domain controller. Otherwise, message processing
continues.</p>
</li><li><p><span>    </span>The server MUST
locate a domain controller in the joined domain. <i>DomainControllerString</i>
MUST be equal to the string name of the located domain controller.</p>
</li><li><p><span>    </span>The server MUST
establish an <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_8e961bf0-95ba-4f58-9034-b67ccb27f317" data-linktype="relative-path">authenticated
(1)</a> SMB session with the domain controller named by the value of <i>DomainControllerString</i>.
The credentials that are supplied during authentication are those in <i>PasswordString</i>,
and the security context that is established MUST be that of <i>AccountName</i>.
If an error occurs, the server MUST stop message processing and return that
error. Otherwise, message processing continues.</p>
</li><li><p><span>  </span>The SMB session established
in the previous step and the security context associated with it MUST be used
for any higher layer RPC calls made to the domain controller over the SMB <b>NCACN_NP</b>
protocol sequence (<a href="../ms-smb/f210069c-7086-4dc2-885e-861d837df688" data-linktype="relative-path">[MS-SMB]</a>
section <a href="../ms-smb/d3b7bcd3-cd68-4d3b-916b-443ccd55f953" data-linktype="relative-path">3.2.4.2.4</a>).</p>
</li><li><p><span>  </span>The server MUST configure
the local Net Logon Remote Protocol (<a href="../ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f" data-linktype="relative-path">[MS-NRPC]</a>)
so that it is aware of no longer being joined to a domain.</p>
</li><li><p><span>  </span>The server MUST configure
the local <a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_43e51d0a-ac6a-4662-a99a-8f3029b78caf" data-linktype="relative-path">W32Time</a> (<a href="https://go.microsoft.com/fwlink/?LinkId=90586" data-linktype="external">[WTSREF]</a>) so that it
is aware of no longer being joined to a domain.</p>
</li><li><p><span>  </span>The server MUST set <b>DomainSid</b>
to NULL.</p>
</li><li><p><span>  </span>The server MUST delete the
persisted password that was stored previously in the <b>Password</b> ADM
element when processing a <b>NetrJoinDomain3</b> message.</p>
</li><li><p><span>  </span>If the NETSETUP_ACCT_DELETE
bit is set in <i>Options</i>, the server MUST update the <i>DomainObject</i> <b>userAccountControl</b>
attribute by setting the USER_ACCOUNT_DISABLED bit. See the userAccountControl
Mapping Table (<a href="../ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380" data-linktype="relative-path">[MS-SAMR]</a>
section <a href="../ms-samr/8a193181-a7a2-49df-a8b1-f689aaa6987c" data-linktype="relative-path">3.1.5.14.2</a>)
for details on the mapping of these bits in LDAP.</p>
<p>The security context provided to
LDAP is <i>AccountName</i>, and the credential is <i>PasswordString</i>. For
details on attributes and attribute names, see [MS-ADTS]. For details on LDAP,
see <a href="https://go.microsoft.com/fwlink/?LinkId=90326" data-linktype="external">[RFC2252]</a> and <a href="https://go.microsoft.com/fwlink/?LinkId=90327" data-linktype="external">[RFC2253]</a>.</p>
</li><li><p><span>  </span>The server MUST configure
the Certificate Auto Enrollment Service (<a href="https://go.microsoft.com/fwlink/?LinkId=90178" data-linktype="external">[MSFT-AUTOENROLLMENT]</a>
and <a href="../ms-cersod/ec4bb597-9e73-4d2b-a768-621239e21fca" data-linktype="relative-path">[MS-CERSOD]</a>
section <a href="../ms-cersod/dd492d51-9c18-4d52-a8db-e9cfe35a80b2" data-linktype="relative-path">2.1.2.2.2</a>)
so that it is aware of no longer being joined to a domain.</p>
</li><li><p><span>  </span>The server MUST configure
the local Net Logon Remote Protocol [MS-NRPC] such that it is aware of no
longer being joined to a domain.</p>
</li><li><p><span>  </span>The server SHOULD store the
Internet host name locally such that the DNS service unregisters name records
for the local computer <a href="https://go.microsoft.com/fwlink/?LinkId=90234" data-linktype="external">[NIS]</a>.<a id="Appendix_A_Target_144"></a><a aria-label="Product behavior note 144" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_144" data-linktype="relative-path">&lt;144&gt;</a></p>
</li><li><p><span>  </span>The server SHOULD remove the
domain admins group from the local administrators group, and the server SHOULD
remove the domain users group from the local users groups ([MS-SAMR]).</p>
</li><li><p><span>  </span>The server MUST set the
following ADM elements (section 3.2.1.6) to NULL: <b>ClientName</b>, <b>DomainName</b>,
<b>DomainSid</b>, <b>ForestNameFQDN</b>, <b>DomainGuid</b>, <b>SiteName</b>,
and <b>Password</b>.</p>
</li><li><p><span>  </span>The server MUST stop
impersonating the client by invoking the <b>StopImpersonatingClient</b> task
(section <a href="cf258b4a-d66b-4407-85f7-aac7823ec0aa" data-linktype="relative-path">3.2.4.29.7</a>).</p>
</li></ol><p>If no errors occur, the server MUST return NERR_Success.</p></div>