Product SiteDocumentation Site

6.4. Manually Unconfiguring Client Machines

A machine may need to be removed from one FreeIPA domain and moved to another domain or a virtual machine may be copied. There are a number of different situations where a FreeIPA client needs to be reconfigured. The easiest solution is to uninstall the client and then configure it afresh.
ipa-client-install --uninstall
If it is not possible to uninstall the client directly, then the FreeIPA configuration can be manually removed from the virtual machine.


When a machine is unenrolled, the procedure cannot be undone. The machine can only be enrolled again.
  1. Remove the old hostname from the main keytab. This can be done by removing every principal in the realm or by removing specific principals. For example, to remove all principals:
    $ ipa-rmkeytab -k /etc/krb5.keytab -r EXAMPLE.COM
    To remove specific principals:
    $ ipa-rmkeytab -k /etc/krb5.keytab -p host/
  2. Disable tracking in certmonger for every certificate. Each certificate must be removed from tracking individually.
    $ ipa-getcert stop-tracking -n Server-Cert -d /etc/pki/nssdb
    $ ipa-getcert stop-tracking -n Server2-Cert -d /etc/pki/nssdb
  3. Remove the old host from the FreeIPA DNS domain. While this is optional, it cleans up the old FreeIPA entries associated with the system and allows it to be re-enrolled cleanly at a later time.
    $ ipa host-del
  4. If the system should be re-added to a new FreeIPA domain — such as a virtual machine which was moved from one location to another — then the system can be rejoined to FreeIPA using the ipa-join command.
    $ ipa-join