Solved

How to join domain when computer account exists in different OU

Posted on 2009-04-03
8
3,152 Views
Last Modified: 2012-05-06
I am having issues joining computer to the domain using this script provided and Windows Server 2008.

What is happening is when the computer is in a different OU and we try to join to the computer to a new OU, the computer never joins the domain.

Is it possible to join the computer to the new OU and just move the domain it currently resides in?
Const JOIN_DOMAIN = 1 
Const ACCT_CREATE = 2 
Const ACCT_DELETE = 4 
Const WIN9X_UPGRADE = 16 
Const DOMAIN_JOIN_IF_JOINED = 32 
Const JOIN_UNSECURE = 64 
Const MACHINE_PASSWORD_PASSED = 128 
Const DEFERRED_SPN_SET = 256 
Const INSTALL_INVOCATION = 262144 
 
 
strKeyPath = "Software\!TESTEB"
strComputer = "."
Const HKEY_LOCAL_MACHINE = &H80000002
Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinUsername",strJoinUsername
objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinPassword",strJoinPassword
 
strUser = "ASDF\" & strJoinUsername
strPassword = strJoinPassword
strDomain = "ASDF.com"
strOU = "OU=Processing,OU=ASDFComputers,DC=ASDF,DC=com"
 
Set objNetwork = CreateObject("WScript.Network") 
strComputer = objNetwork.ComputerName 
 
Set objComputer = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & strComputer & "\root\cimv2:Win32_ComputerSystem.Name='" & strComputer & "'")  
 
ReturnValue = objComputer.JoinDomainOrWorkGroup(strDomain, _ 
strPassword, strUser, strOU, JOIN_DOMAIN + DOMAIN_JOIN_IF_JOINED + ACCT_CREATE)
 
If ReturnValue = 0 Then
	objReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinUsername"
	objReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,"JoinPassword"
	objReg.DeleteValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultPassword"
	objReg.SetStringValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","AutoAdminLogon","0"
  objReg.SetStringValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultUserName","ASDF"
  Else
  
End If
 
Set strDomain = Nothing 
Set strUser = Nothing 
Set strPassword = Nothing 
Set strOU = Nothing

Open in new window

0
Comment
Question by:mlptechnical
  • 4
  • 4
8 Comments
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064676
I'm a little confused.  If a computer account exists in a domain, and you have rights to join that computer to the domain, then you can do so.  

If a computer account already exists anywhere in the AD structure, then you can not create a new computer account with that same name.  You just need to use ADUC and move the existing account to to the new OU.

Does that help?  If not, then could you clearify a bit?
0
 

Author Comment

by:mlptechnical
ID: 24064712
I can try and explain a scenario....

TestEB01 exists in the OU:
 "OU=Processing,OU=Desktops,OU=ASDFComputers,DC=DallasMlp,DC=com"

TestEB01 gets re-imaged, and the join domain script on the new image points towards:
 "OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com"

I want the script to join this newly imaged computer to the domain in the "ProcessingNew" OU.

I know that you said that if a computer exists on the domain you can't create a new account, but if the computer is joined to the same OU, my script runs perfectly.

Any ideas on a script that will have a computer join the new OU with no hands on interaction?
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064744
Well... since the computer account already exists, you can just run this simple script to move it to the ProcessingNew OU.

Set objNewOU = GetObject("LDAP://OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com")

Set objMoveComputer = objNewOU.MoveHere _
    ("LDAP://CN=atl-pro-03,CN=Computers,DC=fabrikam,DC=com", "CN=atl-pro-03")
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:mlptechnical
ID: 24064769
It's not that easy though, i don't know for sure which OU the computer will be in, and I don't want to have to create a script for every scenario.

and will just moving the OU join this newly imaged, unjoined server to the domain?
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 24064911
I think you have two seperate issues...  You want a machine computer account moved to a new OU, and you want that freshly imaged machine joined to the domain.  I would use a simple script such as this to join the computer to the domain:

Const JOIN_DOMAIN = 1
Const ACCT_CREATE = 2
Const ACCT_DELETE = 4
Const WIN9X_UPGRADE = 16
Const DOMAIN_JOIN_IF_JOINED = 32
Const JOIN_UNSECURE = 64
Const MACHINE_PASSWORD_PASSED = 128
Const DEFERRED_SPN_SET = 256
Const INSTALL_INVOCATION = 262144
 
strDomain = "FABRIKAM"
strPassword = "ls4k5ywA"
strUser = "shenalan"
 
Set objNetwork = CreateObject("WScript.Network")
strComputer = objNetwork.ComputerName
 
Set objComputer = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _
    strComputer & "\root\cimv2:Win32_ComputerSystem.Name='" & _
        strComputer & "'")
 
ReturnValue = objComputer.JoinDomainOrWorkGroup(strDomain, _
    strPassword, strDomain & "\" & strUser, NULL, _
        JOIN_DOMAIN + ACCT_CREATE)

Then once your on the domain and you have rebooted, use this script to find the computer account you are on in AD and move it to the ProcessingNew OU

Set WshNetwork = WScript.CreateObject("WScript.Network")      'Network Object
Const ADS_SCOPE_SUBTREE = 2

Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"

Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "Select distinguishedName, Name from " & _
        "'LDAP://DC=fabrikam,DC=com' where objectClass='computer'" & _
            " and Name = '" & WshNetwork.ComputerName"'"  
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst

Do Until objRecordSet.EOF
Set objNewOU = GetObject("LDAP://OU=ProcessingNew,OU=ASDFComputers,DC=DallasMlp,DC=com")

Set objMoveComputer = objNewOU.MoveHere _
    (DistinguishedName, "CN=" & Name)
Loop

That is mostly untested, but it will probably give you a good place to start.
0
 

Author Comment

by:mlptechnical
ID: 24064933
that's the script i posted in my question. It's really don't care if the existing computer account is moved or deleted, i just don't want to have any interaction, i needs to be automated so anyone can use it
0
 
LVL 17

Accepted Solution

by:
Jared Luker earned 250 total points
ID: 24064961
Once that second script is tweaked for your environment, anyone who has the rights in AD to the original and the destination OU's would be able to move the computer account.  I can't put in the info for your domain because I don't know what it is.
0
 

Author Comment

by:mlptechnical
ID: 24088920
That option works, but it adds a lot of reboots to our imaging process. Is it possible to lookup and delete the computer account before you join the computer to the domain, then join the computer to the domain?

Keep in mind that you would need to pass the logon credentials because you are not joined to the domain yet.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question