10

What is the point of creating a computer object in Active Directory when you still have to join computers to the domain, which then creates the object anyway?

16

When you create the account first you can place it in the right OU (and with the right security groups, creds to Evan Anderson) from the start.

  • 2
    ...and the right security groups. "Computers are people, too." – Evan Anderson Jul 15 '09 at 19:42
  • At least they're users too, for now :) – Oskar Duveborn Aug 24 '16 at 7:42
  • 1
    I love that you replied to a comment that's 7 years old. I further love that I'm replying to that reply. >smile< Nice to hear from you, Oskar! It's been a long time and I don't get around these parts too much anymore. – Evan Anderson Aug 24 '16 at 21:19
9

You can pre-create a computer object and assign permission to a non-admin to perform the join.

7

We delegated out the ability to create computer accounts. However, we have delegated it to the appropriate OU for the organization. So given the typical contoso.com that Microsoft uses, imagine that there is an OU for Europe. We want to make sure all the computer objects get created in Europe by the European admins. That ensures all GPOs apply appropriately and it ensures that you don't get this cluttered computers folder at the root. When the US admins come along, they can only create computer accounts in the US OU. Again, GPOs apply properly, etc. It also ensures that a US admin can't take out a Europe computer account. You get the idea.

  • 2
    Perfect example. In general, I think most small organizations (less than 200 - 300 computer objects) won't feel the need to precreate computer objects as long as they have processes in place to move the object later. – Dayton Brown Jul 15 '09 at 20:40
  • Delegation of control and pre-creating computer objects are different things. You want pre-created computer objects. When your "tech monkey" puts the PC on the desk, sets the name, and joins the domain you want the startup scripts and GPOs necessary to prep the machine and install all of the software onto the factory fresh image to "just work". I love those kind of PC deployments, and I'd shoot for it in an organization with 10 PCs (because eventually the computers are going to get replaced). – Evan Anderson Jul 16 '09 at 2:40
  • Actually, they are tied together. If you've got multiple admin groups, and you've deployed a multiple OU model to support them, then you delegate control to create computers in particular OUs (you don't give an admin the ability to create computer accounts everywhere). This ensures the computer accounts stay in the right place. However, that means they have to be pre-created as a result. – K. Brian Kelley Jul 16 '09 at 2:49
0

I don't think I have ever created a computer object manually before, so why would you? Is there a reason to specifically create computer objects in an AD structure without joining that computer to the domain?

  • If you have a group policy structure that requires certain computer accounts to be in certain OUs, you can ensure it isn't misplaced by creating it first. Otherwise, it goes in the default "Servers" OU if created dynamically. – spoulson Jul 15 '09 at 19:36
  • 2
    It goes into "Computers" by default, unless you change the default. It's a container, not an OU. – ThatGraemeGuy Jul 15 '09 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.