How do I remove a service connection point in Active Directory

Question

I need to remove a Service Connection Point (SCP) from Active Directory, but I’m not entirely sure about the proper way to do it.

• Is there a PowerShell command or tool to delete SCP entries?
• What precautions should I take to avoid breaking services that depend on it?
• Does removing an SCP require Domain Admin privileges?

Would appreciate step-by-step guidance on correctly removing an SCP from AD.

Answer 1

Removing a Service Connection Point (SCP) from Active Directory (AD) requires careful consideration to avoid disrupting services that depend on it. Here's a comprehensive guide to assist you:

1. Understanding Service Connection Points (SCPs):

SCPs are objects in AD that enable client applications to locate services within a network. They are commonly used by applications like Microsoft Exchange, System Center Configuration Manager (SCCM), and others to publish service information. Before removing an SCP, ensure that no services or applications rely on it for functionality.

2. Identifying the SCP to Remove:

To locate the specific SCP you intend to remove, you can use the Active Directory Service Interfaces Editor (ADSI Edit) or PowerShell.

Using ADSI Edit:

1. Open ADSI Edit (adsiedit.msc).

2. Connect to the Configuration Naming Context.

3. Navigate to the path where the SCP is located. For example, for an Exchange Autodiscover SCP, the path might be:

   CN=ServerName,CN=Autodiscover,CN=Protocols,CN=ServerName,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=OrganizationName,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DomainName,DC=Suffix

4. Right-click on the SCP object and select Delete.

Using PowerShell:

To identify SCPs using PowerShell, execute the following commands:

$scp = "serviceConnectionPoint"
$keywords = "{GUID}*"  # Replace {GUID} with the specific GUID associated with the SCP
Get-ADObject -SearchScope Subtree -Filter { objectClass -eq $scp -and keywords -like $keywords }

This script searches for SCPs matching the specified GUID. Once identified, you can remove the SCP using the Remove-ADObject cmdlet:

Remove-ADObject -Identity "DistinguishedName_of_SCP" -Confirm:$false

Replace "DistinguishedName_of_SCP" with the distinguished name of the SCP object you wish to delete.

3. Precautions Before Removal:

• Backup: Always back up the current state of AD before making modifications.
• Dependencies: Verify that no applications or services depend on the SCP. Removing an active SCP can disrupt associated services.
• Permissions: Ensure you have the necessary permissions to delete the SCP. Typically, domain administrator privileges are required.

4. Required Permissions:

Modifying or deleting SCPs generally requires domain administrator privileges. Ensure your account has the appropriate permissions to perform these actions.

5. Post-Removal Considerations:

After removing the SCP, monitor your environment to ensure that no services are adversely affected. If issues arise, you may need to restore the SCP or reconfigure affected services.

Example Use Case: Removing an Exchange Autodiscover SCP

In scenarios where an on-premises Exchange server has been decommissioned, but its Autodiscover SCP remains in AD, Outlook clients might attempt to connect to the non-existent server. To prevent this:

• Remove the SCP:

  • Using PowerShell:

    Set-ClientAccessServer -Identity "ServerName" -AutoDiscoverServiceInternalUri $null

    This command clears the AutodiscoverServiceInternalUri, effectively removing the SCP.

  • Using ADSI Edit:

    Navigate to the SCP as described earlier, and delete it manually.

• Verify Removal:

  Use Outlook's Test E-mail AutoConfiguration feature to ensure it no longer references the old SCP.