1

I am learning AD at the moment. At my DC under "Active Directory Users and Computers" -> can anyone tell me what the use of creating a new computer ?

I have created user accounts and is able to login using the user account created from any PC/Server joined to the domain.

When a PC join the domain, its computer name got added into the "Computers" folder.

So , creating an user account allow logging into the domain from any PC joined to the domain.

What's the user of creating a computer then ? Since the computer get automatically added, when 1st joined to the domain.

Am i missing anything ?

2 Answers 2

2

If you pre-stage (or pre-create) the Computer account, you can do things like:

  • Create the computer in a specific OU, instead of the default location.
  • Grant/delegate permissions on the Computer account for administration.
  • Use Windows Deployment Services to treat computers based on whether the computer account exists or which OU the computer account is in.
5
  • does it means for a PC joining a domain; if i have pre-created a computer in the AD, i would need to set the same Computer name on the PC "before" joining the domain ?
    – tiongmaru
    Mar 1, 2016 at 15:16
  • Yes that is correct.
    – pat o.
    Mar 1, 2016 at 15:29
  • thanks - last q, if i grant certain permissions a,b,c to computerZ, and certain permission x,y,z to userA . if domain UserA login to domain using ComputerZ, the total permision will be a,b,c,x,y,z ?
    – tiongmaru
    Mar 1, 2016 at 16:10
  • No. Permissions on the computer account are for granting permission to perform a specific action on the computer account itself, such as resetting the computer account password.
    – pat o.
    Mar 1, 2016 at 18:07
  • what is the difference between an computer account password and a domain user account password ?
    – tiongmaru
    Mar 2, 2016 at 10:46
1

You can set special ACL on all object in active directory, like computer.

If you delegated some admin right to a junior admin to join PC in the domain, to only reset the computer account, then the "empty" container must exist, so the site admin need to know all account that will be added, to keep a control over the domain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .