Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

How to join domain when computer account exists in different OU

Posted on 2009-04-03
8
Medium Priority
?
3,527 Views
Last Modified: 2012-05-06
I am having issues joining computer to the domain using this script provided and Windows Server 2008.

What is happening is when the computer is in a different OU and we try to join to the computer to a new OU, the computer never joins the domain.

Is it possible to join the computer to the new OU and just move the domain it currently resides in?
Const JOIN_DOMAIN = 1 
Const ACCT_CREATE = 2 
Const ACCT_DELETE = 4 
Const WIN9X_UPGRADE = 16 
Const DOMAIN_JOIN_IF_JOINED = 32 
Const JOIN_UNSECURE = 64 
Const MACHINE_PASSWORD_PASSED = 128 
Const DEFERRED_SPN_SET = 256 
Const INSTALL_INVOCATION = 262144 
 
 
strKeyPath = "Software\!TESTEB"
strComputer = "."
Const HKEY_LOCAL_MACHINE = &H80000002
Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinUsername",strJoinUsername
objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinPassword",strJoinPassword
 
strUser = "ASDF\" & strJoinUsername
strPassword = strJoinPassword
strDomain = "ASDF.com"
strOU = "OU=Processing,OU=ASDFComputers,DC=ASDF,DC=com"
 
Set objNetwork = CreateObject("WScript.Network") 
strComputer = objNetwork.ComputerName 
 
Set objComputer = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & strComputer & "\root\cimv2:Win32_ComputerSystem.Name='" & strComputer & "'")  
 
ReturnValue = objComputer.JoinDomainOrWorkGroup(strDomain, _ 
strPassword, strUser, strOU, JOIN_DOMAIN + DOMAIN_JOIN_IF_JOINED + ACCT_CREATE)
 
If ReturnValue = 0 Then
	objReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinUsername"
	objReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinPassword"
	objReg.DeleteValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultPassword"
	objReg.SetStringValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","AutoAdminLogon","0"
  objReg.SetStringValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultUserName","ASDF"
  Else
  
End If
 
Set strDomain = Nothing 
Set strUser = Nothing 
Set strPassword = Nothing 
Set strOU = Nothing

Open in new window

0
Comment
Question by:mlptechnical
  • 4
  • 4
8 Comments
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064676
I'm a little confused.  If a computer account exists in a domain, and you have rights to join that computer to the domain, then you can do so.  

If a computer account already exists anywhere in the AD structure, then you can not create a new computer account with that same name.  You just need to use ADUC and move the existing account to to the new OU.

Does that help?  If not, then could you clearify a bit?
0
 

Author Comment

by:mlptechnical
ID: 24064712
I can try and explain a scenario....

TestEB01 exists in the OU:
 "OU=Processing,OU=Desktops,OU=ASDFComputers,DC=DallasMlp,DC=com"

TestEB01 gets re-imaged, and the join domain script on the new image points towards:
 "OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com"

I want the script to join this newly imaged computer to the domain in the "ProcessingNew" OU.

I know that you said that if a computer exists on the domain you can't create a new account, but if the computer is joined to the same OU, my script runs perfectly.

Any ideas on a script that will have a computer join the new OU with no hands on interaction?
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064744
Well... since the computer account already exists, you can just run this simple script to move it to the ProcessingNew OU.

Set objNewOU = GetObject("LDAP://OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com")

Set objMoveComputer = objNewOU.MoveHere _
    ("LDAP://CN=atl-pro-03,CN=Computers,DC=fabrikam,DC=com", "CN=atl-pro-03")
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:mlptechnical
ID: 24064769
It's not that easy though, i don't know for sure which OU the computer will be in, and I don't want to have to create a script for every scenario.

and will just moving the OU join this newly imaged, unjoined server to the domain?
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064911
I think you have two seperate issues...  You want a machine computer account moved to a new OU, and you want that freshly imaged machine joined to the domain.  I would use a simple script such as this to join the computer to the domain:

Const JOIN_DOMAIN = 1
Const ACCT_CREATE = 2
Const ACCT_DELETE = 4
Const WIN9X_UPGRADE = 16
Const DOMAIN_JOIN_IF_JOINED = 32
Const JOIN_UNSECURE = 64
Const MACHINE_PASSWORD_PASSED = 128
Const DEFERRED_SPN_SET = 256
Const INSTALL_INVOCATION = 262144
 
strDomain = "FABRIKAM"
strPassword = "ls4k5ywA"
strUser = "shenalan"
 
Set objNetwork = CreateObject("WScript.Network")
strComputer = objNetwork.ComputerName
 
Set objComputer = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _
    strComputer & "\root\cimv2:Win32_ComputerSystem.Name='" & _
        strComputer & "'")
 
ReturnValue = objComputer.JoinDomainOrWorkGroup(strDomain, _
    strPassword, strDomain & "\" & strUser, NULL, _
        JOIN_DOMAIN + ACCT_CREATE)

Then once your on the domain and you have rebooted, use this script to find the computer account you are on in AD and move it to the ProcessingNew OU

Set WshNetwork = WScript.CreateObject("WScript.Network")      'Network Object
Const ADS_SCOPE_SUBTREE = 2

Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"

Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "Select distinguishedName, Name from " & _
        "'LDAP://DC=fabrikam,DC=com' where objectClass='computer'" & _
            " and Name = '" & WshNetwork.ComputerName"'"  
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst

Do Until objRecordSet.EOF
Set objNewOU = GetObject("LDAP://OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com")

Set objMoveComputer = objNewOU.MoveHere _
    (DistinguishedName, "CN=" & Name)
Loop

That is mostly untested, but it will probably give you a good place to start.
0
 

Author Comment

by:mlptechnical
ID: 24064933
that's the script i posted in my question. It's really don't care if the existing computer account is moved or deleted, i just don't want to have any interaction, i needs to be automated so anyone can use it
0
 
LVL 17

Accepted Solution

by:
Jared Luker earned 1000 total points
ID: 24064961
Once that second script is tweaked for your environment, anyone who has the rights in AD to the original and the destination OU's would be able to move the computer account.  I can't put in the info for your domain because I don't know what it is.
0
 

Author Comment

by:mlptechnical
ID: 24088920
That option works, but it adds a lot of reboots to our imaging process. Is it possible to lookup and delete the computer account before you join the computer to the domain, then join the computer to the domain?

Keep in mind that you would need to pass the logon credentials because you are not joined to the domain yet.
0

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

824 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question