Solved

How to join domain when computer account exists in different OU

Posted on 2009-04-03
8
2,962 Views
Last Modified: 2012-05-06
I am having issues joining computer to the domain using this script provided and Windows Server 2008.

What is happening is when the computer is in a different OU and we try to join to the computer to a new OU, the computer never joins the domain.

Is it possible to join the computer to the new OU and just move the domain it currently resides in?
Const JOIN_DOMAIN = 1 

Const ACCT_CREATE = 2 

Const ACCT_DELETE = 4 

Const WIN9X_UPGRADE = 16 

Const DOMAIN_JOIN_IF_JOINED = 32 

Const JOIN_UNSECURE = 64 

Const MACHINE_PASSWORD_PASSED = 128 

Const DEFERRED_SPN_SET = 256 

Const INSTALL_INVOCATION = 262144 
 
 

strKeyPath = "Software\!TESTEB"

strComputer = "."

Const HKEY_LOCAL_MACHINE = &H80000002

Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinUsername",strJoinUsername

objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinPassword",strJoinPassword
 

strUser = "ASDF\" & strJoinUsername

strPassword = strJoinPassword

strDomain = "ASDF.com"

strOU = "OU=Processing,OU=ASDFComputers,DC=ASDF,DC=com"
 

Set objNetwork = CreateObject("WScript.Network") 

strComputer = objNetwork.ComputerName 
 

Set objComputer = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & strComputer & "\root\cimv2:Win32_ComputerSystem.Name='" & strComputer & "'")  
 

ReturnValue = objComputer.JoinDomainOrWorkGroup(strDomain, _ 

strPassword, strUser, strOU, JOIN_DOMAIN + DOMAIN_JOIN_IF_JOINED + ACCT_CREATE)
 

If ReturnValue = 0 Then

	objReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinUsername"

	objReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinPassword"

	objReg.DeleteValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultPassword"

	objReg.SetStringValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","AutoAdminLogon","0"

  objReg.SetStringValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultUserName","ASDF"

  Else

  

End If
 

Set strDomain = Nothing 

Set strUser = Nothing 

Set strPassword = Nothing 

Set strOU = Nothing

Open in new window

0
Comment
Question by:mlptechnical
  • 4
  • 4
8 Comments
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064676
I'm a little confused.  If a computer account exists in a domain, and you have rights to join that computer to the domain, then you can do so.  

If a computer account already exists anywhere in the AD structure, then you can not create a new computer account with that same name.  You just need to use ADUC and move the existing account to to the new OU.

Does that help?  If not, then could you clearify a bit?
0
 

Author Comment

by:mlptechnical
ID: 24064712
I can try and explain a scenario....

TestEB01 exists in the OU:
 "OU=Processing,OU=Desktops,OU=ASDFComputers,DC=DallasMlp,DC=com"

TestEB01 gets re-imaged, and the join domain script on the new image points towards:
 "OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com"

I want the script to join this newly imaged computer to the domain in the "ProcessingNew" OU.

I know that you said that if a computer exists on the domain you can't create a new account, but if the computer is joined to the same OU, my script runs perfectly.

Any ideas on a script that will have a computer join the new OU with no hands on interaction?
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064744
Well... since the computer account already exists, you can just run this simple script to move it to the ProcessingNew OU.

Set objNewOU = GetObject("LDAP://OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com")

Set objMoveComputer = objNewOU.MoveHere _
    ("LDAP://CN=atl-pro-03,CN=Computers,DC=fabrikam,DC=com", "CN=atl-pro-03")
0
 

Author Comment

by:mlptechnical
ID: 24064769
It's not that easy though, i don't know for sure which OU the computer will be in, and I don't want to have to create a script for every scenario.

and will just moving the OU join this newly imaged, unjoined server to the domain?
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064911
I think you have two seperate issues...  You want a machine computer account moved to a new OU, and you want that freshly imaged machine joined to the domain.  I would use a simple script such as this to join the computer to the domain:

Const JOIN_DOMAIN = 1
Const ACCT_CREATE = 2
Const ACCT_DELETE = 4
Const WIN9X_UPGRADE = 16
Const DOMAIN_JOIN_IF_JOINED = 32
Const JOIN_UNSECURE = 64
Const MACHINE_PASSWORD_PASSED = 128
Const DEFERRED_SPN_SET = 256
Const INSTALL_INVOCATION = 262144
 
strDomain = "FABRIKAM"
strPassword = "ls4k5ywA"
strUser = "shenalan"
 
Set objNetwork = CreateObject("WScript.Network")
strComputer = objNetwork.ComputerName
 
Set objComputer = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _
    strComputer & "\root\cimv2:Win32_ComputerSystem.Name='" & _
        strComputer & "'")
 
ReturnValue = objComputer.JoinDomainOrWorkGroup(strDomain, _
    strPassword, strDomain & "\" & strUser, NULL, _
        JOIN_DOMAIN + ACCT_CREATE)

Then once your on the domain and you have rebooted, use this script to find the computer account you are on in AD and move it to the ProcessingNew OU

Set WshNetwork = WScript.CreateObject("WScript.Network")      'Network Object
Const ADS_SCOPE_SUBTREE = 2

Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"

Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "Select distinguishedName, Name from " & _
        "'LDAP://DC=fabrikam,DC=com' where objectClass='computer'" & _
            " and Name = '" & WshNetwork.ComputerName"'"  
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst

Do Until objRecordSet.EOF
Set objNewOU = GetObject("LDAP://OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com")

Set objMoveComputer = objNewOU.MoveHere _
    (DistinguishedName, "CN=" & Name)
Loop

That is mostly untested, but it will probably give you a good place to start.
0
 

Author Comment

by:mlptechnical
ID: 24064933
that's the script i posted in my question. It's really don't care if the existing computer account is moved or deleted, i just don't want to have any interaction, i needs to be automated so anyone can use it
0
 
LVL 17

Accepted Solution

by:
Jared Luker earned 250 total points
ID: 24064961
Once that second script is tweaked for your environment, anyone who has the rights in AD to the original and the destination OU's would be able to move the computer account.  I can't put in the info for your domain because I don't know what it is.
0
 

Author Comment

by:mlptechnical
ID: 24088920
That option works, but it adds a lot of reboots to our imaging process. Is it possible to lookup and delete the computer account before you join the computer to the domain, then join the computer to the domain?

Keep in mind that you would need to pass the logon credentials because you are not joined to the domain yet.
0

Join & Write a Comment

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now