question

DarteyBanahene-4041 avatar image
0 Votes"
DarteyBanahene-4041 asked

Turning off Azure AD Connect. Removing local Domain Controller

Hello, I've got a slight issue.
I've been tasked with removing our local domain controller with the end goals being;

  1. Our user base is 100% Cloud only

  2. We eliminate the need for Azure AD Connect

  3. Make sure that all machines in our environment are registered in Azure AD and InTune

I am trying to find out if there is a streamlined way to accomplish this without having to restore my entire user base considering once Azure AD is disconnected the users would be deleted in O365.

So far I've read and tested that when they are deleted you can restore the account and not loose any data.

Is there a way to do this in bulk, as in restore my entire company in one fell swoop?
Is it even reasonable to think this way or can this be scripted? I ask because it seems as if you can only select one user at a time to restore.

I've created an OU in our Local AD infrastructure that AAD Sync doesn't look at so that I can keep the accounts active just in case I have to roll things back and maintain the structure. I greatly appreciate any and all advice here.



azure-active-directoryazure-ad-connect
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

michev avatar image
0 Votes"
michev answered HendhyHendhy-4986 commented

They will NOT be deleted from Azure AD, you simply need to disable DirSync in the tenant settings first: https://docs.microsoft.com/en-us/office365/enterprise/turn-off-directory-synchronization

The process might take a while depending on the size of the organization, and once its complete you can manage the users directly in the cloud.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@michev

Thank you for the link, just to clarify what I meant by deleted, is that
the accounts will delete from Office 365. Not Azure AD.

0 Votes 0 ·

Hi @michev

I have questions: if I disable DirSync by executing Set-MsolDirSyncEnabled -EnableDirSync $false, will the users still be able to login with their existing password? I am avoiding to reset thousands of users' password and distribute them.

Thank you.

Regards,
Hendhy

0 Votes 0 ·