<div class="content"><p> </p><p>The <b>NetrRenameMachineInDomain3</b> method uses encrypted
credentials to change the locally persisted variable <b>ComputerNameNetBIOS</b>
(section <span><a href="e0b508bc-764d-48b7-b44b-4f93c3d5cf8c" data-linktype="relative-path">3.2.1.5</a></span>) and to
optionally rename the computer account for a server currently in a <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_b0276eb2-4e65-4cf1-a718-e0920a614aca" data-linktype="relative-path">domain</a></span>,
without first removing the computer from the domain and then adding it back.<a id="Appendix_A_Target_80"></a><a id="Appendix_A_Target_145"></a><a aria-label="Product behavior note 145" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_145" data-linktype="relative-path">&lt;145&gt;</a></p><dl>
<dd>
<div><pre> unsigned long NetrRenameMachineInDomain3(
   [in] handle_t RpcBindingHandle,
   [in, string, unique] wchar_t* ServerName,
   [in, string, unique] wchar_t* MachineName,
   [in, string, unique] wchar_t* AccountName,
   [in, unique] PJOINPR_ENCRYPTED_USER_PASSWORD Password,
   [in] unsigned long Options
 );
</pre></div>
</dd></dl><p><b>RpcBindingHandle:</b> An <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a></span> binding <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_5044babb-08e3-4bb9-bc12-fe8f542b05ee" data-linktype="relative-path">handle</a></span>
(see <span><a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a></span>).</p><p><b>ServerName: </b>This parameter has no effect on
message processing in any environment. The client MUST set this parameter to a
value that resolves to the IP protocol layer destination address of the RPC
packets it transmits (<span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/7063c7bd-b48b-42e7-9154-3c2ec4113c0d" data-linktype="relative-path">2.1.1.2</a></span>).
The server MUST ignore this parameter.</p><p><b>MachineName: </b>A pointer to a string that
specifies the new <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_9a7bc8b3-3374-4608-8f73-be20a90b898b" data-linktype="relative-path">computer name</a></span>. This
parameter is optional. If this parameter is NULL, the current machine name is
used.</p><p><b>AccountName: </b>A pointer to a string that
specifies an account name in the joined domain to use when connecting to a <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">domain
controller (DC)</a></span>. This parameter is optional. If this parameter is
NULL, the caller&#39;s account name is used.</p><p><b>Password: </b>An optional pointer to a <b>JOINPR_ENCRYPTED_USER_PASSWORD_AES</b>
structure (section <span><a href="b3b6d235-29e8-44ec-a723-8fb06a0799d8" data-linktype="relative-path">2.2.5.19</a></span>) that
specifies the encrypted password to use with the <i>AccountName</i> parameter.
If this parameter is NULL, the caller&#39;s <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_88d49f20-6c95-4b64-a52c-c3eca2fe5709" data-linktype="relative-path">security context</a></span>
MUST be used.</p><p><b>Options: </b>A 32-bit bitfield that specifies
modifications to default server behavior in message processing.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value/code</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>NETSETUP_ACCT_CREATE </p>
  <p>0x00000002</p>
  </td>
  <td>
  <p>Renames the computer account in the domain. If this
  flag is not set, the computer name is changed locally but no changes are made
  to the computer account in the domain.</p>
  </td>
 </tr><tr>
  <td>
  <p>NETSETUP_DNS_NAME_CHANGES_ONLY</p>
  <p>0x00001000</p>
  </td>
  <td>
  <p>Limits any updates to <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_604dcfcd-72f5-46e5-85c1-f3ce69956700" data-linktype="relative-path">DNS</a></span>-based names
  only.</p>
  </td>
 </tr></tbody></table>
</dd></dl><p><b>Return Values: </b>When the message processing
result meets the description in column two of the following table, this method
MUST return one of the following values (<span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>
section <span><a href="../ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d" data-linktype="relative-path">2.2</a></span>).</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value/code</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>NERR_Success</p>
  <p>0x00000000</p>
  </td>
  <td>
  <p>The operation completed successfully.</p>
  </td>
 </tr><tr>
  <td>
  <p>ERROR_ACCESS_DENIED</p>
  <p>0x00000005</p>
  </td>
  <td>
  <p>Access is denied.</p>
  </td>
 </tr><tr>
  <td>
  <p>ERROR_NOT_SUPPORTED</p>
  <p>0x00000032</p>
  </td>
  <td>
  <p>The request is not supported.</p>
  </td>
 </tr><tr>
  <td>
  <p>ERROR_INVALID_PASSWORD</p>
  <p>0x00000056</p>
  </td>
  <td>
  <p>The specified network password is not correct.</p>
  </td>
 </tr><tr>
  <td>
  <p>ERROR_INVALID_PARAMETER</p>
  <p>0x00000057</p>
  </td>
  <td>
  <p>The parameter is incorrect.</p>
  </td>
 </tr><tr>
  <td>
  <p>RPC_S_PROTSEQ_NOT_SUPPORTED</p>
  <p>0x000006A7</p>
  </td>
  <td>
  <p>The <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_0c171cc7-e9c4-41b6-95a9-536db0042c7a" data-linktype="relative-path">RPC protocol sequence</a></span>
  is not supported.</p>
  </td>
 </tr><tr>
  <td>
  <p>NERR_SetupNotJoined</p>
  <p>0x00000A84</p>
  </td>
  <td>
  <p>This computer is not currently joined to a domain.</p>
  </td>
 </tr><tr>
  <td>
  <p>NERR_SetupDomainController</p>
  <p>0x00000A85</p>
  </td>
  <td>
  <p>This computer is a domain controller and cannot be
  renamed.<a id="Appendix_A_Target_81"></a><a id="Appendix_A_Target_146"></a><a aria-label="Product behavior note 146" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_146" data-linktype="relative-path">&lt;146&gt;</a></p>
  </td>
 </tr></tbody></table>
</dd></dl><p>Any other return value MUST conform to the error code
requirements in <b>Protocol Details</b> (section <span><a href="aeea622a-ea3e-40cc-a9b1-b4a2a3b2bf6b" data-linktype="relative-path">3</a></span>).</p><p>Unless otherwise noted, if the server encounters an error
during message processing, the server SHOULD revert any state changes made,
MUST stop message processing, and MUST return the error to the caller.<a id="Appendix_A_Target_82"></a><a id="Appendix_A_Target_147"></a><a aria-label="Product behavior note 147" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_147" data-linktype="relative-path">&lt;147&gt;</a></p><p>The following definitions are used in the specification of
message processing that follows:</p><ol><li><p><span>    </span><i>DomainControllerString</i>:
A <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_409411c4-b4ed-4ab6-b0ee-6d7815f85a35" data-linktype="relative-path">UTF-8</a></span>
string that contains the name of a domain controller in the domain to which the
server is joined.</p>
</li><li><p><span>    </span><i>NewComputerAccountString</i>:
A UTF-8 string that contains the value to be stored in the samAccountName
attribute of the server&#39;s computer account in the domain database.</p>
</li><li><p><span>    </span><i>ComputerNameString</i>:
A UTF-8 string that contains the new <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_0334e0bd-2755-42f6-aeff-2d4a22bf4abf" data-linktype="relative-path">NetBIOS name</a></span> of the
server.</p>
</li><li><p><span>    </span><i>DNSComputerNameString</i>:
A UTF-8 string that contains the new <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_4d5d5403-372f-4f9f-8d7a-65c310c807d9" data-linktype="relative-path">Internet host name</a></span>
of the server.</p>
</li><li><p><span>    </span><i>Spn1</i>: A
UTF-8 string.</p>
</li><li><p><span>    </span><i>Spn2</i>: A
UTF-8 string.</p>
</li><li><p><span>    </span><i>PasswordString</i>:
A UTF-8 string that contains a password in <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_f6e0fdd0-cbc1-4c9d-93b8-f25125f9c5ef" data-linktype="relative-path">cleartext</a></span>.</p>
</li><li><p><span>    </span><i>DomainControllerConnection</i>:
An ADCONNECTION_HANDLE (<span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>
section <span><a href="../ms-dtyp/5faf669e-34a9-471b-aaff-8591b9650189" data-linktype="relative-path">2.2.2</a></span>)
to a domain controller.</p>
</li><li><p><span>    </span><i>LdapResultMessages</i>:
A list of LDAPMessage (<span><a href="https://go.microsoft.com/fwlink/?LinkId=90325" data-linktype="external">[RFC2251]</a></span>)
containing results from an operation performed on DomainControllerConnection.</p>
</li><li><p><span>  </span><i>ComputerAccountDN</i>: A
UTF-8 string that contains the <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_1175dd11-9368-41d5-98ed-d585f268ad4b" data-linktype="relative-path">distinguished name (DN)</a></span>
of the computer account.</p>
</li></ol><p>The following statements define the sequence of message
processing operations.</p><ol><li><p><span>    </span>The server MUST
retrieve the RPC protocol sequence used for the current call ([MS-RPCE] section
<span><a href="../ms-rpce/0ceefe4c-0d7a-423f-bcd0-54e821767f89" data-linktype="relative-path">3.1.3.4.1</a></span>)
specifying the server binding handle maintained by the RPC runtime ([C706]
section 6.2.1). If that RPC protocol sequence is not <b>NCACN_NP</b>, the
server SHOULD return <b>RPC_S_PROTSEQ_NOT_SUPPORTED</b>.<a id="Appendix_A_Target_83"></a><a id="Appendix_A_Target_148"></a><a aria-label="Product behavior note 148" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_148" data-linktype="relative-path">&lt;148&gt;</a></p>
</li><li><p><span>    </span>The server MUST
check that the caller has been granted access rights using the algorithm in the
<b>Access Control Abstract Data Model</b> (section <span><a href="c5b75090-3de2-404f-8de1-d5ca3fc38a70" data-linktype="relative-path">3.2.1.1</a></span>), with <i>Access
Request mask</i> initialized to <b>WKSTA_NETAPI_CHANGE_CONFIG</b>; if not, the
server MUST return ERROR_ACCESS_DENIED.</p>
</li><li><p><span>    </span>The server MUST
impersonate the client by invoking the <b>StartImpersonatingClient</b> task
(section <span><a href="719ae534-d5d7-4c42-9989-d63e0676fad1" data-linktype="relative-path">3.2.4.29.6</a></span>). If
this operation fails, the server MUST return an error.</p>
</li><li><p><span>    </span>If <i>Password</i>
is NULL then <i>PasswordString</i> MUST be NULL. Otherwise, the server MUST
decrypt and decode the <i>Password</i> (section 2.2.5.19). <i>PasswordString</i>
MUST be equal to the decrypted and decoded value. The decrypted buffer is
represented as a <b>JOINPR_USER_PASSWORD</b> structure (section <span><a href="6320ca78-6492-4eaf-ad95-a558ad399383" data-linktype="relative-path">2.2.5.17</a></span>).
The value of the <b>Length</b> member MUST be less than 513; otherwise, message
processing is stopped, and the server MUST return ERROR_INVALID_PASSWORD.</p>
</li><li><p><span>    </span>If the server is
not a domain controller, or is not a member of a domain, the server MUST fail
the call with NERR_SetupNotJoined. Otherwise, message processing continues.</p>
</li><li><p><span>    </span>If the server is
an <span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_8b0a073b-3099-4efe-8b81-c2886b66a870" data-linktype="relative-path">RODC</a></span>
(<span><a href="../ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47" data-linktype="relative-path">[MS-DRSR]</a></span>
section <span><a href="../ms-drsr/b5e068cf-1b68-479b-9c7f-98f081223d25" data-linktype="relative-path">5.7</a></span>),
the server MUST fail the call with ERROR_NOT_SUPPORTED. Otherwise, message
processing continues.</p>
</li><li><p><span>    </span>If the <i>Options</i>
parameter does not contain <b>NETSETUP_ACCT_CREATE</b>, the server MUST apply
the new name locally, updating <b>ComputerNameNetBIOS</b> so that other
protocols on the server can operate using the new name. If this operation
fails, the server MUST return an implementation-specific error and stop message
processing. If the operation is successful, the server MUST stop message
processing and return successfully.</p>
</li><li><p><span>    </span>If the <i>Options</i>
parameter contains <b>NETSETUP_ACCT_CREATE</b>, the server MUST continue
message processing.</p>
</li><li><p><span>    </span>The server MUST
convert<a id="Appendix_A_Target_84"></a><a id="Appendix_A_Target_149"></a><a aria-label="Product behavior note 149" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_149" data-linktype="relative-path">&lt;149&gt;</a> the
name in the <i>MachineName</i> parameter to a string NetBIOS name. This
conversion MUST match with the conversion used in Netlogon Remote Protocol. <i>ComputerNameString</i>
MUST equal the resulting value. <i>NewComputerAccountString</i> MUST equal the
resulting value concatenated with the &#34;$&#34; character.</p>
</li><li><p><span>  </span>The server MUST use the
security context associated with the credentials provided in the <i>AccountName</i>
and <i>Password</i> parameters to perform the rest of the remote operations.</p>
</li><li><p><span>  </span>The server MUST locate a
writable domain controller for the domain to which the server is joined, by
invoking the <b>DsrGetDcNameEx2</b> method on the local <span><a href="../ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f" data-linktype="relative-path">[MS-NRPC]</a></span>
server specifying the following parameters:</p>
<ul><li><p><span><span>  </span></span><i>ComputerName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>AccountName</i>
= <b>ComputerNameNetBIOS</b></p>
</li><li><p><span><span>  </span></span><i>AllowableAccountControlBits</i>
= ADS_UF_WORKSTATION_TRUST_ACCOUNT | ADS_UF_SERVER_TRUST_ACCOUNT (<span><a href="../ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a" data-linktype="relative-path">[MS-ADTS]</a></span>
section <span><a href="../ms-adts/dd302fd1-0aa7-406b-ad91-2a6b35738557" data-linktype="relative-path">2.2.16</a></span>)</p>
</li><li><p><span><span>  </span></span><i>DomainName</i>
= <b>DomainNameFQDN </b>(section 3.2.1.5)</p>
</li><li><p><span><span>  </span></span><i>DomainGuid</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>SiteName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>Flags</i>
= (J | B) ([MS-NRPC] section <span><a href="../ms-nrpc/fb8e1146-a045-4c31-98d1-c68507ad5620" data-linktype="relative-path">3.5.4.3.1</a></span>)</p>
<p>If the <b>DsrGetDcNameEx2</b>
method fails, the server MUST retry the call specifying the following
parameters:</p>
</li><li><p><span><span>  </span></span><i>ComputerName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>AccountName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>AllowableAccountControlBits</i>
= 0</p>
</li><li><p><span><span>  </span></span><i>DomainName</i>
= <b>DomainNameFQDN</b></p>
</li><li><p><span><span>  </span></span><i>DomainGuid</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>SiteName</i>
= NULL</p>
</li><li><p><span><span>  </span></span><i>Flags</i>
= (J | B) ([MS-NRPC] section 3.5.4.3.1)</p>
<p>If both calls fail, the
method MUST fail.</p>
<p>Otherwise,
DomainControllerString MUST equal the string name of the returned writable
domain controller.</p>
</li></ul></li><li><p><span>  </span>If the
NETSETUP_DNS_NAME_CHANGES_ONLY bit is not set in <i>Options</i>, the server
MUST make the following attribute update:</p>
<ul><li><p><span><span>  </span></span>samAccountName
updated to equal NewComputerAccountString.</p>
</li></ul></li><li><p><span>  </span><i>DNSComputerNameString</i>
is the concatenation of <i>ComputerNameString</i> and the DNS suffix on the
server.<a id="Appendix_A_Target_85"></a><a id="Appendix_A_Target_150"></a><a aria-label="Product behavior note 150" href="def80006-2495-4571-8a93-1668e0f8af31#Appendix_A_150" data-linktype="relative-path">&lt;150&gt;</a> </p>
</li><li><p><span>  </span><i>Spn1</i> is the
concatenation of &#34;HOST/&#34; with <i>DNSComputerNameString</i>.</p>
</li><li><p><span>  </span><i>Spn2</i> is the
concatenation of &#34;HOST/&#34; with <i>ComputerNameString</i>.</p>
</li><li><p><span>  </span>The server invokes <b>LDAP
Bind</b> (section <span><a href="54bb5e23-7947-4516-a04a-d354b11f6207" data-linktype="relative-path">3.2.4.29.2</a></span>) with
the following parameters:</p>
<ul><li><p><span><span>  </span></span><i>DomainControllerBindTarget</i>:
DomainControllerString</p>
</li><li><p><span><span>  </span></span><i>AccountNameForBind</i>:
AccountName</p>
</li><li><p><span><span>  </span></span><i>PasswordForBind</i>:
PasswordString</p>
</li><li><p><span><span>  </span></span><i>Encrypt</i>:
FALSE</p>
</li><li><p><span><span>  </span></span><i>DisallowReferrals</i>:
FALSE</p>
<p>The result is stored in
DomainControllerConnection.</p>
</li></ul></li><li><p><span>  </span>The server invokes <b>Query
Computer Account DN for the Local Machine</b> (section <span><a href="c2058c35-790a-4fa9-b8c4-14b19447985e" data-linktype="relative-path">3.2.4.29.1</a></span>),
specifying DomainControllerString for the <i>DomainControllerQueryTarget</i>
parameter, storing the result in ComputerAccountDN.</p>
</li><li><p><span>  </span>The server invokes the
&#34;Performing an LDAP Operation on an ADConnection&#34; task of [MS-ADTS]
section 7.6.1.6 with the following parameters:</p>
<ul><li><p><span><span>  </span></span><i>TaskInputADConnection</i>:
DomainControllerConnection</p>
</li><li><p><span><span>  </span></span><i>TaskInputRequestMessage</i>:
<span><a href="3acf0e02-9bbd-4ce0-a7a0-586bc72d3ef4#gt_45643bfb-b4c4-432c-a10f-b98790063f8d" data-linktype="relative-path">LDAP</a></span>
modifyRequest message [RFC2251] section 4.6 as follows:</p>
<ul><li><p><span><span> 
</span></span>Object: ComputerAccountDN</p>
</li><li><p><span><span> 
</span></span>The modification sequence has two list entries, set as follows:</p>
<ul><li><p><span><span> 
</span></span>First list entry</p>
<ul><li><p><span><span> 
</span></span>operation: replace</p>
</li><li><p><span><span> 
</span></span>modification:</p>
<ul><li><p><span><span> 
</span></span>type: DnsHostName</p>
</li><li><p><span><span> 
</span></span>vals: DNSComputerNameString</p>
</li></ul></li></ul></li><li><p><span><span> 
</span></span>Second list entry</p>
<ul><li><p><span><span> 
</span></span>operation: replace</p>
</li><li><p><span><span> 
</span></span>modification:</p>
<ul><li><p><span><span> 
</span></span>type: ServicePrincipalName</p>
</li><li><p><span><span> 
</span></span>vals: Spn1 and Spn2</p>
</li></ul></li></ul></li></ul></li></ul></li><li><p><span><span>  </span></span><i>TaskOutputResultMessages</i>:
LDAPResultMessages</p>
</li></ul></li><li><p><span>  </span>The server invokes <b>LDAP
Unbind</b> (section <span><a href="ed6bf2f1-8c20-4d7f-85c0-a7643190b3ac" data-linktype="relative-path">3.2.4.29.3</a></span>), with
ADConnectionToUnbind set to DomainControllerConnection.</p>
</li><li><p><span>  </span>If any of these updates
fail, the server MUST fail the request and return the error from the writable
domain controller.</p>
</li><li><p><span>  </span>The server MUST invoke
&#34;Update Display Name using SAMR&#34; (section <span><a href="2b244a0a-f7a9-4878-8828-3b2998b11737" data-linktype="relative-path">3.2.4.29.5</a></span>),
specifying the following parameters:</p>
<ul><li><p><span><span>  </span></span><i>DomainController</i>:
<i>DomainControllerString</i></p>
</li><li><p><span><span>  </span></span><i>MachineName</i>:
<i>NewComputerNameString</i></p>
<p>The result of this
operation MUST be ignored.</p>
</li></ul></li><li><p><span>  </span>The server MUST apply the
new name locally, updating <b>ComputerNameNetBIOS</b> so that other protocols
on the server can operate using the new name.</p>
</li><li><p><span>  </span>The server MUST stop
impersonating the client by invoking the <b>StopImpersonatingClient</b> task
(section <span><a href="cf258b4a-d66b-4407-85f7-aac7823ec0aa" data-linktype="relative-path">3.2.4.29.7</a></span>).</p>
</li></ol><p>If no errors occur, the server MUST return NERR_Success.</p></div>