Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the point of creating a computer object in Active Directory when you still have to join computers to the domain, which then creates the object anyway?

share|improve this question

4 Answers 4

up vote 13 down vote accepted

When you create the account first you can place it in the right OU (and with the right security groups, creds to Evan Anderson) from the start.

share|improve this answer
2  
...and the right security groups. "Computers are people, too." –  Evan Anderson Jul 15 '09 at 19:42

You can pre-create a computer object and assign permission to a non-admin to perform the join.

share|improve this answer

We delegated out the ability to create computer accounts. However, we have delegated it to the appropriate OU for the organization. So given the typical contoso.com that Microsoft uses, imagine that there is an OU for Europe. We want to make sure all the computer objects get created in Europe by the European admins. That ensures all GPOs apply appropriately and it ensures that you don't get this cluttered computers folder at the root. When the US admins come along, they can only create computer accounts in the US OU. Again, GPOs apply properly, etc. It also ensures that a US admin can't take out a Europe computer account. You get the idea.

share|improve this answer
1  
Perfect example. In general, I think most small organizations (less than 200 - 300 computer objects) won't feel the need to precreate computer objects as long as they have processes in place to move the object later. –  Dayton Brown Jul 15 '09 at 20:40
    
Delegation of control and pre-creating computer objects are different things. You want pre-created computer objects. When your "tech monkey" puts the PC on the desk, sets the name, and joins the domain you want the startup scripts and GPOs necessary to prep the machine and install all of the software onto the factory fresh image to "just work". I love those kind of PC deployments, and I'd shoot for it in an organization with 10 PCs (because eventually the computers are going to get replaced). –  Evan Anderson Jul 16 '09 at 2:40
    
Actually, they are tied together. If you've got multiple admin groups, and you've deployed a multiple OU model to support them, then you delegate control to create computers in particular OUs (you don't give an admin the ability to create computer accounts everywhere). This ensures the computer accounts stay in the right place. However, that means they have to be pre-created as a result. –  K. Brian Kelley Jul 16 '09 at 2:49

I don't think I have ever created a computer object manually before, so why would you? Is there a reason to specifically create computer objects in an AD structure without joining that computer to the domain?

share|improve this answer
    
If you have a group policy structure that requires certain computer accounts to be in certain OUs, you can ensure it isn't misplaced by creating it first. Otherwise, it goes in the default "Servers" OU if created dynamically. –  spoulson Jul 15 '09 at 19:36
2  
It goes into "Computers" by default, unless you change the default. It's a container, not an OU. –  ThatGraemeGuy Jul 15 '09 at 19:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.