diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py
index de6f2b0ca1d..eb52557212e 100644
--- a/python/samba/netcmd/domain.py
+++ b/python/samba/netcmd/domain.py
@@ -718,6 +718,36 @@ class cmd_domain_join(Command):
             raise CommandError("Invalid role '%s' (possible values: MEMBER, DC, RODC)" % role)
 
 
+class cmd_domain_leave(Command):
+    """Cause a domain member to leave the joined domain."""
+
+    synopsis = "%prog [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_options = [
+        Option("--keep-account", action="store_true",
+               help="Disable the machine account instead of deleting it.")
+    ]
+
+    takes_args = []
+
+    def run(self, sambaopts=None, credopts=None, versionopts=None,
+            keep_account=False):
+        lp = sambaopts.get_loadparm()
+        creds = credopts.get_credentials(lp)
+
+        s3_lp = s3param.get_context()
+        smb_conf = lp.configfile if lp.configfile else default_path()
+        s3_lp.load(smb_conf)
+        s3_net = s3_Net(creds, s3_lp)
+        s3_net.leave(keep_account)
+
+
 class cmd_domain_demote(Command):
     """Demote ourselves from the role of Domain Controller."""
 
@@ -4346,6 +4376,7 @@ class cmd_domain(SuperCommand):
         subcommands["exportkeytab"] = cmd_domain_export_keytab()
     subcommands["info"] = cmd_domain_info()
     subcommands["join"] = cmd_domain_join()
+    subcommands["leave"] = cmd_domain_leave()
     if is_ad_dc_built():
         subcommands["demote"] = cmd_domain_demote()
         subcommands["provision"] = cmd_domain_provision()