It will unjoin a machine from a domain and not even start to ask the domain for permission or even tell it it did so, zip, out of the domain, have a nice day. You will find that this will likely be faster than NETDOM for any unjoin ops. It allows you to specify connection creds and will also allow you to specify a reboot. Of course it has a built in safety in that you have to specify -forreal to get it to do the real work or otherwise it will just tell you the current join status of the machine in question (i.e. in a workgroup named xxxx or in a domain named yyyy).