Copyright: Netdom Help vers. © copyright Microsoft Corporation 1996-1997
Citation: Netdom Help vers. © copyright Microsoft Corporation 1996-1997


Netdom Overview

The Netdom utility allows the administrator to manage domains from the command line. You can use Netdom to accomplish the following tasks:

Joining a domain.

Managing computer accounts for members (for example, adding, deleting, listing, and querying members).

Managing computer accounts for BDCs (for example, adding, deleting, listing, and querying BDCs).

Resetting secure channels on BDCs.

Establishing trust relationships.

Managing resource domain computer accounts (for example, adding, deleting, listing, and querying resource domains).

Note	The syntax used for Netdom is similar to that of the net command.

For questions or problems with Netdom, please contact:

rkinput@microsoft.com.


Using Netdom
Netdom Syntax

The syntax used for running Netdom is similar to that used by the net command.

To run a command, type:

netdom [/options] command

To get help on a command, type:

netdom HELP command

Netdom includes the following options:

Option	Description
/D[OMAIN]:DomainName	Instructs Netdom to perform the operation on the primary domain controller (PDC) of the domain specified by DomainName. If this option is not included, the current domain is used. If the computer is a domain controller, the operation takes place on the current domain.
/U[SER]:Domain\User	Specifies the user account used to make the connection with the PDC on which the action is to be performed. If this option is not included, the current user account is used.
/P[ASSWORD]:password	Specifies the password of the user account specified by the /U option.
/NOVERBOSE	Not verbose. Displays only the results of the performed operation.


Netdom Member

The MEMBER command allows the administrator to accomplish the following tasks:

Join a domain

Add a member computer account

Delete a member computer account

Query the secure channel of a member

List members of a domain

Syntax

netdom [/options] MEMBER [[\\]MemberName] [/command]

Commands

The following commands are available:

Command	Description
(No command)	Lists the members of the domain. Must be used without specifying a MemberName.
/JOINDOMAIN	Joins a domain. Resets the secure channel if the member was already in the domain.
/ADD	Adds a computer account for the member.
/DELETE	Removes the computer account for the member.
/QUERY	Queries domain information about the member.
Examples

NETDOM /Domain:mydomain /user:mydomainuser /password:apassword
MEMBER mycomputer /JOINDOMAIN

NETDOM /Domain:mydomain MEMBER mycomputer /JOINDOMAIN

NETDOM /Domain:mydomain MEMBER mycomputer /ADD

NETDOM /Domain:mydomain MEMBER mycomputer /DELETE

NETDOM member mycomputer /QUERY

Note	For details about the options, see Netdom syntax.


Netdom BDC

The BDC command allows the administrator to accomplish the following tasks:

Reset a BDC's secure channels

Add a BDC computer account

Delete a BDC computer account

Query the secure channel of a BDC

List the BDCs in a domain

Syntax

netdom [/options] BDC [[\\]BdcName] [/command]

Commands

The following commands are available:

Options	Description
(No command)	Lists the BDCs in the domain. Must be used without specifying a BdcName.
/ADD	Adds a computer account to the BDC.
/DELETE	Removes the computer account from the BDC.
/QUERY	Queries domain information on the BDC and checks the secure channel.
/RESET	Resets the secure channel of the BDC.

Examples

NETDOM /Domain:mydomain /User:mydomain\AUser /Password:apassword
BDC mybdc /ADD

NETDOM /Domain:mydomain BDC mybdc /ADD

NETDOM /Domain:mydomain BDC mybdc /DELETE

NETDOM BDC mybdc /QUERY

NETDOM BDC mybdc /RESET

Note	For details about the options, see Netdom syntax.


Netdom Resource

The Resource command allows the administrator to accomplish the following tasks:

Add a resource domain computer account

Delete a resource domain computer account

Query the secure channel of a resource domain

List the resource domains of a master domain

Syntax

netdom [/options] RESOURCE [ResourceDomain] [password] [/command]

Commands

The following commands are available:

Options	Description
(No command)	Lists the resource domains of the master domain. Must be used without specifying ResourceDomain.
/ADD	Adds an account on the resource domain. You can specify a password on the command line. If you do not specify a password, a default password is used (the resource domain name in lower case, truncated to 14 characters).
/DELETE	Removes an account from the resource domain.
/QUERY	Queries the resource domain account. Checks the secure channel between the resource domain and the master domain.
Examples

NETDOM /Domain:MyMasterDomain /User:MyMasterDomain\AUser
/Password:apassword RESOURCE MyResourceDomain MyPassword /ADD

NETDOM /Domain:MyMasterDomain RESOURCE MyResourceDomain MyPassword /ADD

NETDOM /Domain:MyMasterDomain RESOURCE MyResourceDomain /DELETE

NETDOM /Domain:MyMasterDomain RESOURCE MyResourceDomain /QUERY

Note	For details about the options, see Netdom syntax.


Netdom Master

The Master command allows the administrator to accomplish the following tasks:

Establish a trust relationship between the current domain and the master domain

Delete a master domain trust relationship

Query the secure channel of a trust relationship

List the master domains of a resource domain

Syntax

netdom [/options] MASTER [MasterDomain] [password] [/command]

Commands

The following commands are available:

Options	Description
(No command)	Lists the resource domains of the master domain. Must be used without specifying MasterDomain.
/TRUST	Establishes a trust relationship between the resource domain and the master domain. The resource domain is the current domain or the domain specified using the /DOMAIN option. Resets the secure channel if the trust relationship already existed. You can specify a password on the command line. If you do not specify a password, a default password is used (the resource domain name in lower case, truncated to 14 characters).
/DELETE	Removes account from the resource domain.
/QUERY	Queries the master domain information on the resource domain's PDC and checks the secure channel.

Examples

NETDOM /Domain:MyResourceDomain /User:MyResourceDomain\Auser
/Password:apassword MASTER MyMasterDomain MyPassword /TRUST

NETDOM /Domain:MyResourceDomain MASTER MyMasterDomain MyPassword /TRUST

NETDOM /Domain:MyResourceDomain MASTER MyMasterDomain /TRUST

NETDOM /Domain:MyResourceDomain MASTER MyMasterDomain /DELETE

NETDOM /Domain:MyResourceDomain MASTER MyMasterDomain /QUERY

Note	For details about the options, see Netdom syntax.


Netdom Query

The Query command allows the administrator to query the computer role in a domain. Netdom QUERY queries computer domain information and checks secure channels. It can be run for any domain member or BDC.

Syntax

netdom [/options] QUERY [[\\] Computer]

The only option allowed is /NOVERBOSE. When the /NOVERBOSE option is specified, Netdom Query displays only the results of the performed operation.

Examples

NETDOM QUERY

NETDOM QUERY MyComputer

NETDOM QUERY \\MyComputer


Joining a Domain

Netdom allows you to join a domain from the command line. This applies to Windows NT workstations and standalone servers. Depending on your access privileges, you can accomplish the following tasks.

Domain administrator

If you have administrator access to the PDC of the domain (if you are logged on as a member of the Local Administrators or Domain Admins groups), you can create a computer account, using the following syntax:

NETDOM /Domain:mydomain /user:adminuser /password:apassword MEMBER
mycomputer /JOINDOMAIN

Not domain administrator

If you do not have administrator access to the PDC of the domain, you must perform the following steps:

1	Ask the administrator to add a computer account for your computer, using the following syntax:

   NETDOM /Domain:mydomain /user:adminuser /password:apassword MEMBER
mycomputer /ADD

2	Then join the domain, using the following syntax:

   NETDOM /Domain:mydomain /user:adminuser /password:apassword MEMBER
mycomputer /JOINDOMAIN


Building a Trust Relationship
Establishing a Trust Relationship

Netdom allows you to establish a trust relationship from the command line. If you have administrator access to the resource domain, run the following command to create a resource computer account and establish a trust relationship in one step:

NETDOM/Domain:MyResourceDomain /User:MyResourceDomain \AdminUser
/Password:apassword MASTER MyMasterDomain MyPassword /TRUST

Note	The command shown above can be run from the Master Domain PDC or from any computer running Windows NT as long as you have an administrator access to the master domain.

Alternatively, to establish a trust relationship you may perform the following steps:

1	On the master domain, create a resource computer account, using the following syntax:

   NETDOM/Domain:MyMasterDomain RESOURCE MyResourceDomain MyPassword
/ADD

2	On the resource domain, establish trust on the master domain using the following syntax:

   NETDOM/Domain:MyResourceDomain MASTER MyMasterDomain MyPassword
/TRUST


Querying Computer Role
Querying a Computer Role within a Domain

Netdom allows you to query the role of a computer from the command line. At the same time, it checks the secure channel.

To run this command, use the following syntax:

NETDOM QUERY \\MyComputer


Resetting BDC Secure Channel
Resetting a BDC Secure Channel

For each BDC, there is a secure channel (a discrete communication channel) between the BDC and the PDC. The NetLogon service uses this secure channel to communicate information. This secure channel requires a password. On the PDC the password is stored in the computer account in the Security Accounts Manager (SAM) database, whereas on the BDC it is stored in Local Security Authority (LSA) information.

Netdom allows you to reset the secure channel of a BDC. This can be useful when the NetLogon service on the BDC cannot start due to a secure channel problem. The NetLogon service writes an error in the system event log on the BDC. This situation could arise for one of the following reasons:

The name of the BDC has been changed

The Emergency Repair Disk has been used with old information

The BDC computer account has been removed

To reset the BDC secure channel

Type the following at the command prompt:

NETDOM BDC MyBdc /RESET


Resetting Domain Member Secure Channel
Resetting a Domain Member Secure Channel

For each domain member, there is a secure channel (a discrete communication channel) between the member and the PDC. The NetLogon service uses this secure channel to communicate information. This secure channel requires a password. On the PDC the password is stored in the computer account in the SAM database, whereas on the member it is stored in LSA information.

Netdom allows you to reset the secure channel of the member. This can be useful when the NetLogon service on the member cannot start due to a secure channel problem. The NetLogon service writes an error in the system event log of the member. This situation could arise for one of the following reasons:

The name of the member computer has been changed

The Emergency Repair Disk has been used with old information

The member computer account has been removed

To reset the member secure channel

Type the following at the command prompt:

NETDOM /Domain:MyDomain MEMBER MyComputer /JOINDOMAIN

Note	The JOINDOMAIN command detects whether the member previously belonged to the domain. If this is the case, it also checks the secure channel and resets it automatically if necessary.


Resetting Trust Relationship Secure Channel
Resetting a Trust Relationship Secure Channel

In the context of Windows NT, a trust relationship is the relationship that exists between two Windows NT domains. Each of these domains is either a trusting domain or a trusted domain. For any given trust relationship, there is a secure channel (a discrete communication channel) between each domain controller in the trusting domain, and a domain controller in the trusted domain.

This secure channel requires a password. The password is stored in the resource domain computer account in the SAM database on the PDC of the master domain, and is replicated to all BDCs. The password is also stored on the PDC of the resource domain under LSA, and replicated to all BDCs.

Netdom allows you to reset the secure channel of a trust relationship. It affects the PDC of the resource domain and the PDC of the master domain. This can be useful when the NetLogon service on the resource domain PDC cannot start due to a secure channel problem. The NetLogon service then logs an error in the system event logs of the resource domain PDC. This situation could arise for one of the following reasons:

The domain name has changed

The Emergency Repair Disk has been used with old information

The resource domain member computer account has been removed

To reset a trust relationship secure channel

Type the following at the command prompt:

NETDOM /Domain:MyResourceDomain /User:MyResourceDomain\AUser
/Password:apassword MASTER MyMasterDomain MyPassword /TRUST

The MASTER /TRUST command detects whether the trust relationship already existed. If this is the case, it also checks the secure channel and resets it automatically if necessary.