1

I am learning AD at the moment. At my DC under "Active Directory Users and Computers" -> can anyone tell me what the use of creating a new computer ?

I have created user accounts and is able to login using the user account created from any PC/Server joined to the domain.

When a PC join the domain, its computer name got added into the "Computers" folder.

So , creating an user account allow logging into the domain from any PC joined to the domain.

What's the user of creating a computer then ? Since the computer get automatically added, when 1st joined to the domain.

Am i missing anything ?

2

If you pre-stage (or pre-create) the Computer account, you can do things like:

  • Create the computer in a specific OU, instead of the default location.
  • Grant/delegate permissions on the Computer account for administration.
  • Use Windows Deployment Services to treat computers based on whether the computer account exists or which OU the computer account is in.
5
  • does it means for a PC joining a domain; if i have pre-created a computer in the AD, i would need to set the same Computer name on the PC "before" joining the domain ? – tiongmaru Mar 1 '16 at 15:16
  • Yes that is correct. – pat o. Mar 1 '16 at 15:29
  • thanks - last q, if i grant certain permissions a,b,c to computerZ, and certain permission x,y,z to userA . if domain UserA login to domain using ComputerZ, the total permision will be a,b,c,x,y,z ? – tiongmaru Mar 1 '16 at 16:10
  • No. Permissions on the computer account are for granting permission to perform a specific action on the computer account itself, such as resetting the computer account password. – pat o. Mar 1 '16 at 18:07
  • what is the difference between an computer account password and a domain user account password ? – tiongmaru Mar 2 '16 at 10:46
1

You can set special ACL on all object in active directory, like computer.

If you delegated some admin right to a junior admin to join PC in the domain, to only reset the computer account, then the "empty" container must exist, so the site admin need to know all account that will be added, to keep a control over the domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.