<div class="content"><p> </p><p>The <b>NetrRenameMachineInDomain2</b> method uses encrypted
credentials to change the locally persisted variable <b>ComputerNameNetBIOS</b>
(section <span><a href="e0b508bc-764d-48b7-b44b-4f93c3d5cf8c" data-linktype="relative-path">3.2.1.5</a></span>) and to
optionally rename the computer account for a server currently in a <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_b0276eb2-4e65-4cf1-a718-e0920a614aca" data-linktype="relative-path">domain</a></span>,
without first removing the computer from the domain and then adding it back.<span><a aria-label="Product behavior note 81" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_81" data-linktype="relative-path">&lt;81&gt;</a></span></p><dl>
<dd>
<div><pre> unsigned long NetrRenameMachineInDomain2(
   [in] handle_t RpcBindingHandle,
   [in, string, unique] wchar_t* ServerName,
   [in, string, unique] wchar_t* MachineName,
   [in, string, unique] wchar_t* AccountName,
   [in, unique] PJOINPR_ENCRYPTED_USER_PASSWORD Password,
   [in] unsigned long Options
 );
</pre></div>
</dd></dl><p><b>RpcBindingHandle:</b> An <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a></span> binding <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_5044babb-08e3-4bb9-bc12-fe8f542b05ee" data-linktype="relative-path">handle</a></span>
<span><a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a></span>.</p><p><b>ServerName: </b>This parameter has no effect on
message processing in any environment. The client MUST set this parameter to a
value that resolves to the IP protocol layer destination address of the RPC
packets it transmits (<span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/7063c7bd-b48b-42e7-9154-3c2ec4113c0d" data-linktype="relative-path">2.1.1.2</a></span>).
The <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_434b0234-e970-4e8c-bdfa-e16a30d96703" data-linktype="relative-path">server
(2)</a></span> MUST ignore this parameter.</p><p><b>MachineName: </b>A pointer to a string that
specifies the new <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_9a7bc8b3-3374-4608-8f73-be20a90b898b" data-linktype="relative-path">computer name</a></span>. This
parameter is optional. If this parameter is NULL, the current machine name is
used.</p><p><b>AccountName: </b>A pointer to a string that
specifies an account name in the joined domain to use when connecting to a <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">domain
controller</a></span>. This parameter is optional. If this parameter is NULL,
the caller&#39;s account name is used.</p><p><b>Password: </b>An optional pointer to a <b>JOINPR_ENCRYPTED_USER_PASSWORD</b>
structure (section <span><a href="7ac423e6-4d90-4dd8-b16b-c5a3783f0509" data-linktype="relative-path">2.2.5.18</a></span>) that
specifies the encrypted password to use with the <i>AccountName</i> parameter.
If this parameter is NULL, the caller&#39;s <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_88d49f20-6c95-4b64-a52c-c3eca2fe5709" data-linktype="relative-path">security context</a></span>
MUST be used.</p><p><b>Options: </b>A 32-bit bitfield that specifies
modifications to default server behavior in message processing.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value/code</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>NETSETUP_ACCT_CREATE </p>
  <p>0x00000002</p>
  </td>
  <td>
  <p>Renames the computer account in the domain. If this
  flag is not set, the computer name is changed locally but no changes are made
  to the computer account in the domain.</p>
  </td>
 </tr><tr>
  <td>
  <p>NETSETUP_DNS_NAME_CHANGES_ONLY</p>
  <p>0x00001000</p>
  </td>
  <td>
  <p>Limits any updates to <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_604dcfcd-72f5-46e5-85c1-f3ce69956700" data-linktype="relative-path">DNS</a></span>-based names
  only.</p>
  </td>
 </tr></tbody></table>
</dd></dl><p><b>Return Values: </b>When the message processing
result meets the description in column two of the following table, this method
MUST return one of the following values (<span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>
section <span><a href="../ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d" data-linktype="relative-path">2.2</a></span>).</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value/code</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>NERR_Success</p>
  <p>0x00000000</p>
  </td>
  <td>
  <p>The operation completed successfully.</p>
  </td>
 </tr><tr>
  <td>
  <p>ERROR_ACCESS_DENIED</p>
  <p>0x00000005</p>
  </td>
  <td>
  <p>Access is denied.</p>
  </td>
 </tr><tr>
  <td>
  <p>ERROR_NOT_SUPPORTED</p>
  <p>0x00000032</p>
  </td>
  <td>
  <p>The request is not supported.</p>
  </td>
 </tr><tr>
  <td>
  <p>ERROR_INVALID_PASSWORD</p>
  <p>0x00000056</p>
  </td>
  <td>
  <p>The specified network password is not correct.</p>
  </td>
 </tr><tr>
  <td>
  <p>ERROR_INVALID_PARAMETER</p>
  <p>0x00000057</p>
  </td>
  <td>
  <p>The parameter is incorrect.</p>
  </td>
 </tr><tr>
  <td>
  <p>RPC_S_PROTSEQ_NOT_SUPPORTED</p>
  <p>0x000006A7</p>
  </td>
  <td>
  <p>The <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_0c171cc7-e9c4-41b6-95a9-536db0042c7a" data-linktype="relative-path">RPC protocol sequence</a></span>
  is not supported.</p>
  </td>
 </tr><tr>
  <td>
  <p>NERR_SetupNotJoined</p>
  <p>0x00000A84</p>
  </td>
  <td>
  <p>This computer is not currently joined to a domain.</p>
  </td>
 </tr><tr>
  <td>
  <p>NERR_SetupDomainController</p>
  <p>0x00000A85</p>
  </td>
  <td>
  <p>This computer is a domain controller and cannot be
  renamed.<span><a aria-label="Product behavior note 82" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_82" data-linktype="relative-path">&lt;82&gt;</a></span></p>
  </td>
 </tr></tbody></table>
</dd></dl><p>Any other return value MUST conform to the error code
requirements in <b>Protocol Details</b> (section <span><a href="aeea622a-ea3e-40cc-a9b1-b4a2a3b2bf6b" data-linktype="relative-path">3</a></span>).</p><p>Unless otherwise noted, if the server encounters an error
during message processing, the server SHOULD revert any state changes made, MUST
stop message processing, and MUST return the error to the caller.<span><a aria-label="Product behavior note 83" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_83" data-linktype="relative-path">&lt;83&gt;</a></span></p><p>The following definitions are used in the specification of
message processing that follows:</p><ul><li><p><span><span> 
</span></span><i>DomainControllerString</i>: A <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_409411c4-b4ed-4ab6-b0ee-6d7815f85a35" data-linktype="relative-path">UTF-8</a></span> string that
contains the name of a domain controller in the domain to which the server is
joined.</p>
</li><li><p><span><span> 
</span></span><i>NewComputerAccountString</i>: A UTF-8 string that contains the
value to be stored in the samAccountName attribute of the server&#39;s computer
account in the domain database.</p>
</li><li><p><span><span> 
</span></span><i>ComputerNameString</i>: A UTF-8 string that contains the new <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_0334e0bd-2755-42f6-aeff-2d4a22bf4abf" data-linktype="relative-path">NetBIOS
name</a></span> of the server.</p>
</li><li><p><span><span> 
</span></span><i>DNSComputerNameString</i>: A UTF-8 string that contains the
new <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_4d5d5403-372f-4f9f-8d7a-65c310c807d9" data-linktype="relative-path">Internet
host name</a></span> of the server.</p>
</li><li><p><span><span> 
</span></span><i>Spn1</i>: A UTF-8 string.</p>
</li><li><p><span><span> 
</span></span><i>Spn2</i>: A UTF-8 string.</p>
</li><li><p><span><span> 
</span></span><i>PasswordString</i>: A UTF-8 string that contains a password in
<span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_f6e0fdd0-cbc1-4c9d-93b8-f25125f9c5ef" data-linktype="relative-path">cleartext</a></span>.</p>
</li><li><p><span><span> 
</span></span><i>DomainControllerConnection</i>: An ADCONNECTION_HANDLE (<span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>
section <span><a href="../ms-dtyp/5faf669e-34a9-471b-aaff-8591b9650189" data-linktype="relative-path">2.2.2</a></span>)
to a domain controller.</p>
</li><li><p><span><span> 
</span></span><i>LdapResultMessages</i>: A list of LDAPMessage (<span><a href="https://go.microsoft.com/fwlink/?LinkId=90325" data-linktype="external">[RFC2251]</a></span>)
containing results from an operation performed on DomainControllerConnection.</p>
</li><li><p><span><span> 
</span></span><i>ComputerAccountDN</i>: A UTF-8 string that contains the <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_1175dd11-9368-41d5-98ed-d585f268ad4b" data-linktype="relative-path">distinguished
name (DN)</a></span> of the computer account.</p>
</li></ul><p>The following statements define the sequence of message
processing operations.</p><ol><li><p><span>    </span>The server (2)
MUST retrieve the RPC protocol sequence used for the current call ([MS-RPCE]
section <span><a href="../ms-rpce/0ceefe4c-0d7a-423f-bcd0-54e821767f89" data-linktype="relative-path">3.1.3.4.1</a></span>)
specifying the server binding handle maintained by the RPC runtime ([C706] section
6.2.1). If that RPC protocol sequence is not <b>NCACN_NP</b>, the server SHOULD
return <b>RPC_S_PROTSEQ_NOT_SUPPORTED</b>.<span><a aria-label="Product behavior note 84" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_84" data-linktype="relative-path">&lt;84&gt;</a></span></p>
</li><li><p><span>    </span>The server MUST
check that the caller has been granted access rights using the algorithm in the
<b>Access Control Abstract Data Model</b> (section <span><a href="c5b75090-3de2-404f-8de1-d5ca3fc38a70" data-linktype="relative-path">3.2.1.1</a></span>), with <i>Access
Request mask</i> initialized to <b>WKSTA_NETAPI_CHANGE_CONFIG</b>; if not, the
server MUST return ERROR_ACCESS_DENIED.</p>
</li><li><p><span>    </span>The server MUST
impersonate the client by invoking the <b>StartImpersonatingClient</b> task
(section <span><a href="719ae534-d5d7-4c42-9989-d63e0676fad1" data-linktype="relative-path">3.2.4.29.6</a></span>). If
this operation fails, the server MUST return an error.</p>
</li><li><p><span>    </span>If <i>Password</i>
is NULL then <i>PasswordString</i> MUST be NULL. Otherwise, the server MUST
decrypt and decode the <i>Password</i> (section 2.2.5.18). <i>PasswordString</i>
MUST be equal to the decrypted and decoded value. The decrypted buffer is
represented as a <b>JOINPR_USER_PASSWORD</b> structure (section <span><a href="6320ca78-6492-4eaf-ad95-a558ad399383" data-linktype="relative-path">2.2.5.17</a></span>).
The value of the <b>Length</b> member MUST be less than 513; otherwise, message
processing is stopped, and the server MUST return ERROR_INVALID_PASSWORD.</p>
</li><li><p><span>    </span>If the server is
not a domain controller, or is not a member of a domain, the server MUST fail
the call with NERR_SetupNotJoined. Otherwise, message processing continues.</p>
</li><li><p><span>    </span>If the server is
an <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_8b0a073b-3099-4efe-8b81-c2886b66a870" data-linktype="relative-path">RODC</a></span>
(<span><a href="../ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47" data-linktype="relative-path">[MS-DRSR]</a></span>
section <span><a href="../ms-drsr/b5e068cf-1b68-479b-9c7f-98f081223d25" data-linktype="relative-path">5.7</a></span>),
the server MUST fail the call with ERROR_NOT_SUPPORTED. Otherwise, message
processing continues.</p>
</li><li><p><span>    </span>If the <i>Options</i>
parameter does not contain <b>NETSETUP_ACCT_CREATE</b>, the server MUST apply
the new name locally, updating <b>ComputerNameNetBIOS</b> so that other
protocols on the server can operate using the new name. If this operation
fails, the server MUST return an implementation-specific error and stop message
processing. If the operation is successful, the server MUST stop message
processing and return successfully.</p>
</li><li><p><span>    </span>If the <i>Options</i>
parameter contains <b>NETSETUP_ACCT_CREATE</b>, the server MUST continue
message processing.</p>
</li><li><p><span>    </span>The server MUST
convert<span><a aria-label="Product behavior note 85" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_85" data-linktype="relative-path">&lt;85&gt;</a></span> the name in the <i>MachineName</i>
parameter to a string NetBIOS name. This conversion MUST match with the
conversion used in Netlogon Remote Protocol. <i>ComputerNameString</i> MUST
equal the resulting value. <i>NewComputerAccountString</i> MUST equal the
resulting value concatenated with the &#34;$&#34; character.</p>
</li><li><p><span>  </span>The server MUST use the
security context associated with the credentials provided in the <i>AccountName</i>
and <i>Password</i> parameters to perform the rest of the remote operations.</p>
</li><li><p><span>  </span>The server MUST locate a
writable domain controller for the domain to which the server is joined, by
invoking the <b>DsrGetDcNameEx2</b> method on the local <span><a href="../ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f" data-linktype="relative-path">[MS-NRPC]</a></span>
server specifying the following parameters:</p>
<ul><li><p><span><span>  </span></span><i>ComputerName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>AccountName</i>
= <b>ComputerNameNetBIOS</b></p>
</li><li><p><span><span>  </span></span><i>AllowableAccountControlBits</i>
= ADS_UF_WORKSTATION_TRUST_ACCOUNT | ADS_UF_SERVER_TRUST_ACCOUNT (<span><a href="../ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a" data-linktype="relative-path">[MS-ADTS]</a></span>
section <span><a href="../ms-adts/dd302fd1-0aa7-406b-ad91-2a6b35738557" data-linktype="relative-path">2.2.16</a></span>)</p>
</li><li><p><span><span>  </span></span><i>DomainName</i>
= <b>DomainNameFQDN </b>(section 3.2.1.5)</p>
</li><li><p><span><span>  </span></span><i>DomainGuid</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>SiteName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>Flags</i>
= (J | B) ([MS-NRPC] section <span><a href="../ms-nrpc/fb8e1146-a045-4c31-98d1-c68507ad5620" data-linktype="relative-path">3.5.4.3.1</a></span>)</p>
<p>If the DsrGetDcNameEx2
method fails, the server MUST retry the call specifying the following
parameters:</p>
</li><li><p><span><span>  </span></span><i>ComputerName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>AccountName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>AllowableAccountControlBits</i>
= 0</p>
</li><li><p><span><span>  </span></span><i>DomainName</i>
= <b>DomainNameFQDN</b></p>
</li><li><p><span><span>  </span></span><i>DomainGuid</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>SiteName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>Flags</i>
= (J | B) ([MS-NRPC] section 3.5.4.3.1)</p>
<p>If both calls fail, the
method MUST fail.</p>
<p>Otherwise,
DomainControllerString MUST equal the string name of the returned writable
domain controller.</p>
</li></ul></li><li><p><span>  </span>If the
NETSETUP_DNS_NAME_CHANGES_ONLY bit is not set in <i>Options</i>, the server
MUST make the following attribute update:</p>
<ul><li><p><span><span>  </span></span>samAccountName
updated to equal NewComputerAccountString.</p>
</li></ul></li><li><p><span>  </span><i>DNSComputerNameString</i>
is the concatenation of <i>ComputerNameString</i> and the DNS suffix on the
server.<a id="Appendix_A_Target_86"></a><a aria-label="Product behavior note 86" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_86" data-linktype="relative-path">&lt;86&gt;</a></p>
</li><li><p><span>  </span><i>Spn1</i> is the
concatenation of &#34;HOST/&#34; with <i>DNSComputerNameString</i>.</p>
</li><li><p><span>  </span><i>Spn2</i> is the
concatenation of &#34;HOST/&#34; with <i>ComputerNameString</i>.</p>
</li><li><p><span>  </span>The server invokes <b>LDAP
Bind</b> (section <span><a href="54bb5e23-7947-4516-a04a-d354b11f6207" data-linktype="relative-path">3.2.4.29.2</a></span>) with
the following parameters:</p>
<ul><li><p><span><span>  </span></span><i>DomainControllerBindTarget</i>:
DomainControllerString</p>
</li><li><p><span><span>  </span></span><i>AccountNameForBind</i>:
AccountName</p>
</li><li><p><span><span>  </span></span><i>PasswordForBind</i>:
PasswordString</p>
</li><li><p><span><span>  </span></span><i>Encrypt</i>:
FALSE</p>
</li><li><p><span><span>  </span></span><i>DisallowReferrals</i>:
FALSE</p>
<p>The result is stored in
DomainControllerConnection.</p>
</li></ul></li><li><p><span>  </span>The server invokes <b>Query
Computer Account DN for the Local Machine</b> (section <span><a href="c2058c35-790a-4fa9-b8c4-14b19447985e" data-linktype="relative-path">3.2.4.29.1</a></span>),
specifying DomainControllerString for the <i>DomainControllerQueryTarget</i>
parameter, storing the result in ComputerAccountDN.</p>
</li><li><p><span>  </span>The server invokes the
&#34;Performing an LDAP Operation on an ADConnection&#34; task of [MS-ADTS]
section <span><a href="../ms-adts/b2131a85-4a8c-4f48-a610-6a4b7a701627" data-linktype="relative-path">7.6.1.6</a></span>
with the following parameters:</p>
<ul><li><p><span><span>  </span></span><i>TaskInputADConnection</i>:
DomainControllerConnection</p>
</li><li><p><span><span>  </span></span><i>TaskInputRequestMessage</i>:
<span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_45643bfb-b4c4-432c-a10f-b98790063f8d" data-linktype="relative-path">LDAP</a></span>
modifyRequest message [RFC2251] section 4.6 as follows:</p>
<ul><li><p><span><span> 
</span></span>Object: ComputerAccountDN</p>
</li><li><p><span><span> 
</span></span>The modification sequence has two list entries, set as follows:</p>
<ul><li><p><span><span> 
</span></span>First list entry</p>
<ul><li><p><span><span> 
</span></span>operation: replace</p>
</li><li><p><span><span> 
</span></span>modification:</p>
<ul><li><p><span><span> 
</span></span>type: DnsHostName</p>
</li><li><p><span><span> 
</span></span>vals: DNSComputerNameString</p>
</li></ul></li></ul></li><li><p><span><span> 
</span></span>Second list entry</p>
<ul><li><p><span><span> 
</span></span>operation: replace</p>
</li><li><p><span><span> 
</span></span>modification:</p>
<ul><li><p><span><span> 
</span></span>type: ServicePrincipalName</p>
</li><li><p><span><span> 
</span></span>vals: Spn1 and Spn2</p>
</li></ul></li></ul></li></ul></li></ul></li><li><p><span><span>  </span></span><i>TaskOutputResultMessages</i>:
LDAPResultMessages</p>
</li></ul></li><li><p><span>  </span>The server invokes <b>LDAP
Unbind</b> (section <span><a href="ed6bf2f1-8c20-4d7f-85c0-a7643190b3ac" data-linktype="relative-path">3.2.4.29.3</a></span>), with
ADConnectionToUnbind set to DomainControllerConnection.</p>
</li><li><p><span>  </span>If any of these updates
fail, the server MUST fail the request and return the error from the writable
domain controller.</p>
</li><li><p><span>  </span>The server MUST invoke
&#34;Update Display Name using SAMR&#34; (section <span><a href="2b244a0a-f7a9-4878-8828-3b2998b11737" data-linktype="relative-path">3.2.4.29.5</a></span>),
specifying the following parameters:</p>
<ul><li><p><span><span>  </span></span><i>DomainController</i>:
<i>DomainControllerString</i></p>
</li><li><p><span><span>  </span></span><i>MachineName</i>:
<i>NewComputerNameString</i></p>
<p>The result of this
operation MUST be ignored.</p>
</li></ul></li><li><p><span>  </span>The server MUST apply the
new name locally, updating <b>ComputerNameNetBIOS</b> so that other protocols
on the server can operate using the new name.</p>
</li><li><p><span>  </span>The server MUST stop
impersonating the client by invoking the <b>StopImpersonatingClient</b> task
(section <span><a href="cf258b4a-d66b-4407-85f7-aac7823ec0aa" data-linktype="relative-path">3.2.4.29.7</a></span>).</p>
</li></ol><p>If no errors occur, the server MUST return NERR_Success.</p></div>