Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are changing the container that AD uses for computers (by default, cn=Computers) by using:

redircmp container-dn container-dn

Has anyone done this in the past and experienced any gotchas that we should be aware of? Much obliged for the advice, tips and/or forewarnings.

share|improve this question
    
You should remove the "default" computer creation limit as well. For all new domains, the default OU should be changed and the ability for users to create 10 computers should be removed. You want people putting anything in "unclaimed". It should be easy to find the folks that are creating accounts there. Default limit to number of workstations a user can join to the domain: support.microsoft.com/kb/243327 –  user170143 Apr 18 '13 at 11:54
add comment

3 Answers 3

up vote 5 down vote accepted

Microsoft have a KB Article on the subject which contains some good information.

Call me naive if you like, but if you don't mind me asking - why are you doing this? Is it really that much of a problem to move new user/computer objects manually to their desired OU? It's only a one off process when a new person starts or a new computer is joined to the domain.

share|improve this answer
2  
... or pre-create the computer object in AD before joining, or make it a part of your image sysconfig :) –  Zypher Nov 11 '10 at 19:01
    
All good suggestions. However, (luckily) we do not do desktop management. We are just assisting with the domain creation. We were told to rename the default container and I'm just trying to figure out potential pitfalls. But +1 for the great suggestions. I'll make sure to pass it along (and I expect it to be ignored :-/). –  Belmin Fernandez Nov 11 '10 at 21:33
2  
Unless you've locked AD down, the default configuration is that any user (not just admins) can add a computer to the domain (up to 10 computers per user); you may want to have them automatically created in a container with more GPO than the domain wide GPOs. Or all computers get dumped in the same OU anyway, and this configuration takes a step out of the process (either pre-creating the account, or moving it after the fact). –  Chris S Nov 12 '10 at 14:24
add comment

We've done it. We made the Computers context an OU instead of a CN, which allowed us to hang GPOs on it. Soon we will be moving it again and calling it 'unclaimed'. Our techs are supposed to pre-create objects before importing, but they don't always do it. Putting the not-pre-created computers into an OU named 'unclaimed' makes it pretty clear who is responsible for what computers... no one.

The one problem you'll run into is older software that assumes the presence of 'cn=computers' in your tree as the default location for stuff. This is happily becoming increasingly rare.

share|improve this answer
    
"The one problem you'll run into is older software that assumes the presence of 'cn=computers' in your tree as the default location for stuff. This is happily becoming increasingly rare." Would a good test be to try moving a few manually before changing the default container? –  Belmin Fernandez Nov 11 '10 at 20:42
add comment
  1. SBS apparently changes this location.
  2. When migrating, Exchange 2013's ECP shows an error when opening users not located in the domain\Users container.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.