I want to know if there is a way I can join a domain and then effectively block all access from the domain to my pc via firewall. I know that I also need to remove the domain accounts from my local machine but what ports do I need to block as well? Thank you, Leto the Just.

Good firewall policy is to block everything by default. Then, allow traffic only on necessary ports. This should effectively block domain traffic. If you want to selectively block only the ports used by Active Directory - which you shouldn't, becuase it is bad firewall policy - block ports 88 445 and 135. This should break your ability to authenticate to the domain. Depending on what you mean by "all access" you may need to block other ports as well. But you will have already done that becuase you are implememting good firewall policies. Right?

how can remove domain accounts locally????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? there are domain accounts so NOT local accounts

Maybe he meant local profiles?

ooglenze, you may want to post this separate issue in it's own thread, and be a little more specific, as Domain Accounts are created on a DC, and local accounts are created on a client/node/machine. Are you talking about removing User Accounts from a DC?

I just want to physically join the domain but block the ports that allow AD and domain admins access to manage my PC.

What do you mean by "physically join the domain?" And what specific management capabilities do you want to block?