Remove Entra Password Protection On-Premises: A Guide

Key insights

• Locate and uninstall Proxy software from existing machines using PowerShell commands designed to identify the serviceConnectionPoint.
• Uninstall DC Agent software from all Domain Controllers, ensuring machines are restarted post-uninstallation to complete the process effectively.
• Remove all Proxy and DC Agent service connection points using PowerShell commands, significantly cleaning from domain naming contexts.
• Eliminate the forest-level configuration state by using PowerShell to remove the Password Protection Config Container, ensuring a thorough cleanup.
• Delete physically existing SYSVOL directory folders related to AzureADPasswordProtection to ensure no remnants are left

The primary focus of the text is on the meticulous process involved in uninstalling Microsoft Entra Password Protection from an on-premises environment. Various steps, including the use of PowerShell scripts, are crucial to locate and eliminate not just the fundamental software but also all associated configurations and service connection points. This is particularly significant for organizations shifting entirely to cloud systems, necessitating a thorough removal of all on-premises password protection mechanisms to maintain system integrity and security. The procedure also includes necessary system reboots and manual deletions from the SYSVOL directory, underscoring the need for comprehensive removal to avoid lingering presence that could affect future operations.

Microsoft Entra Password Protection Uninstallation

This blog post provides a detailed guide on how to uninstall Microsoft Entra Password Protection for on-premises environments. Organizations that have shifted completely to the cloud will need to follow these specific steps to remove all instances of the software.

To begin, administrators are instructed to locate all machines with Proxy software installed using PowerShell commands. Subsequently, the Proxy software should be uninstalled from these machines. Key components include Microsoft Azure AD Connect Agent Updater, Azure AD Password Protection Proxy, and its bundle.

The next steps involve locating and uninstalling DC Agent software installed on Domain Controllers. Specific PowerShell commands are provided to accurately identify these machines. Microsoft's guideline emphasizes the importance of also removing all Proxy and DC Agent connection points and clearing the forest-level configuration state.

• Find all machines with Proxy software installed
• Uninstall Proxy software from these machines
• Identify and uninstall DC Agent software on Domain Controllers
• Remove all connection points and related configuration states
• Finally, access the sysvol directory and remove the AzureADPasswordProtection folder

The process concludes with a cleanup of all system directories and confirmation of removal actions. This thorough removal is critical to ensuring that all remnants of the Microsoft Entra Password Protection are erased, hence securing the system as it transitions fully into a cloud environment.

Read the full article How to Uninstall Microsoft Entra Password Protection for on-premises

People also ask

What is the purpose of Microsoft Entra password protection?