Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I remember back in the olden days of Windows NT you could create "blank" computer accounts so that anyone could join a computer of that name to the domain.

I would like to do the same thing with Active Directory. Specifically:

  • create a "blank" computer account for a member or RODC
  • join the computer to the domain without interaction

The problem I'm trying to solve is I have 1,400 samba4 servers that I need to join to the domain as RODCs. I really, really, really don't want to type in the password 1400 times. I want it to be properly automated (puppet/chef/whatever).

Maybe I can solve this using kssh and Kerberos ticket forwarding? Open to ideas.

share|improve this question
What did you expect? Interesting problem, though. – ewwhite Nov 19 '13 at 19:52
You... you're going to create 1400 RODCs? Am I understanding that right? – Ryan Ries Nov 20 '13 at 4:41
There are weird behaviors and edge cases that you have to be aware of with 1,400 Windows Domain Controllers, nevermind 1,400 samba DCs. If you're asking this question, I'm assuming it's too late to turn back now, but tread very carefully. – MDMarra Nov 21 '13 at 15:11
up vote 6 down vote accepted

My first approach to this would be:

  1. Create a new domain user and give it rights to join computers to the domain.
  2. Embed its username and password into your automation tool (puppet, chef, shell script, whatever).
  3. Once all the computers are joined to the domain, you can delete the domain-joining user. If you keep the user, you should change its password or lock the account.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.