Solved

Active Directory Best Practices with Computer Accounts

Posted on 2008-10-30
4
1,739 Views
Last Modified: 2012-05-05
I have read some knowledge base answers that address this, but not quite as fully as I need. So here is our situation: We have a pretty large number of computers in our domain (3000 +) and Active Directory is constantly outdated because computers are not removed from the Domain correctly. Sometimes this is because of circumstances out of our control (major system crashes) other times it is simply because it is quicker to just re-image computers without removing them from the domain.
The resultant dissarray in AD is the cause for many other applications having unreliable information (such as our antivirus database) which makes it very hard to tell if the computers not getting updates are real or simply phantom accounts long ago abandoned. I know I can do queries about when a computer was last updated, but a very large percentage of our computers are laptops which may or may not have connected within a period of time.
Currently we add computers to the network as we image them, rather than pre-populating AD with names. I need to know some information about doing it the other way. Can I setup AD so only pre-named computer accounts can be used? How do we use those accounts? Previously when we have tried it that way we have gotten errors that "The computer name already exists in the domain." How do we re-use the name when we re-image the computers? (This happens pretty frequently, especially with our mobile computers) I have seen that you can reset computer accounts, but I have never been successful in adding a new computer with a name that is already in AD on a consistant basis. Any help on how this is supposed to work would be great!
0
Comment
Question by:TechInTheWoods
  • 2
  • 2
4 Comments
 
LVL 51

Accepted Solution

by:
Netman66 earned 500 total points
Comment Utility
The first thing to do would be create an OU for your Computer accounts (or multiple OUs) - so that the Computers container (the default one) is never used.  Remove permissions from the Computers Container so that ONLY Domain Admins have rights to add Computers to it.

Next, delegate the proper permissions to the other OUs to add, modify and delete User and Computer accounts using one or more Security Groups.  By doing this, you cannot add computers to the domain from the workstation unless you are a Domain Admin - this will force pre-creation of the computer account in the proper OU before you can add it to the domain.

As far as why you get errors when a computername is pre-created and then you attempt to use it from a workstation - I don't know.  The only way you'd get an error is if the name is in use by another workstation, but not simply by creating it first.

When you reuse a name that already was previously used simply right click the computer name and select Reset account.  This will clear all associations with the object in AD and allow you to re-use it.

0
 

Author Comment

by:TechInTheWoods
Comment Utility
"As far as why you get errors when a computername is pre-created and then you attempt to use it from a workstation - I don't know.  The only way you'd get an error is if the name is in use by another workstation, but not simply by creating it first."

Could this happen because the computers are not properly removed from the domain prior to being re-imaged?
0
 
LVL 51

Expert Comment

by:Netman66
Comment Utility
No.

Reimaging a workstation before removing it from the domain isn't an issue.  Reset the computer account in AD to reuse it.

0
 

Author Comment

by:TechInTheWoods
Comment Utility
Thanks for the guidance on the AD Best Practice. I would still like to know what could cause the issue of not being able to re-use a computer account in AD (Yes, even AFTER it has been reset) but this is good knowledge for configuration, so I will award the points based on that.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

There are two modes of restricted groups GPOs. Replacing mode:   Additive mode:   How do they work? Replacing mode: Everything (users, groups, computers) that is member of the local administrators group will be cleared out. After th…
In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now