[Dailydave] Removing ADS from a Windows machine and giving the machine to someone else

[No One]

Hello all! 

leaving aside hateful thoughts directed at windows, please  consider the following situation:  ·        GIVENS: o   I have a client with multiple locations. The client runs windows active directory.  Each location has an ADScontroller.  o   Client sold one part of its biz, SUB A.  SUBA's IT components are largely contained in its location.  SUB A, at itslocation, has a combination file server/AD server (SUBA-FS1).  o   the new owner of SUB A has elected to keep thisfile server.  o    SUBA-FS1 is running win2k8r2o    SUBA-FS1 is a vm running on a vmware 5.0 server(SUBA-ESX1). o   There are no vmware or vss snapshots. o   The new owner won’t be getting a backup of SUBA-FS1. o    SUBA-ESX1 has been used as a staging area for DRtesting (restoring other VMS).§  Ithas one data store. §  Thesevms have been removed.  §  Ihave added virtual disks to SUBA-FS1 that are the same size as the total freespace and run sysinternals sdelete against the disks, which effectively overwrote all thefree space in vmfs.  ·        QUESTION: o   can I safely give this server to the new owner? o   If so how? ·        MY THOUGHTSo   When I demote the server from domain controllerto member server, windows removes active directory info from the machine. o   I think that this process wipes the data(deletes it and zeroes out the files and folder so that undelete is notpossible) from the disk.  o   I think that even if the process does not wipethe data, if the folder that contains the active directory data is gone and Irun “sdelete –p 5 –c c:” (from sysinternals), then the data will be gone.  If there is no secure way to do this, what is the best I can do? I think I am on the right track but I have been doingthis long enough to realize that I could be missing something. 

i am happy to answer follow up questions.  

Thanks in advance. 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/dailydave/attachments/20160121/657cb49a/attachment-0001.html>