Startup Script to set Description of Computer Account in Active Directory

cantoris
cantoris used Ask the Experts™
on
I'm trying to use a Startup Script deployed to workstations through Group Policy to synchronise the locallly-configured computer description to the description field of the computer account in Active Directory.

It fails with error 0x80070005 (General Access Denied error) but will run manually as domain admin.  The business-end of the script is attached.

Any idea what the problem is and how to best get around it?
Set objSysInfo = CreateObject("ADSystemInfo")
strComputerDN = objSysInfo.ComputerName
Set objComputer = GetObject("LDAP://" & strComputerDN)
objComputer.Put "description", strLocalDescription
objComputer.SetInfo

Open in new window

Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2018
Distinguished Expert 2018
Commented:
The startup script runs in the security context of the *computer* account, which for the obvious reasons has the same permissions in AD as a normal user account.
In other words: you need to delegate the permission to change the attribute "description" for the workstations OU, preferably to the "Self" account (so that each computer account can only change its own description).
From memory: Start the Delegation of Control wizard, "Create custom task" > "Computer Objects" > "Property-specific" > "Write Description"; somewhere along the line you're asked for an account to delegate to, enter "Self" in the search box.
Try this on a new test OU with a test computer account in it first; if it fails, you can move the account back out of the OU, delete the OU, and start over.
If you want to change anything once you're done with the wizard, you'll need to go to the Security tab (in Advanced View in the ADUC console).
Delegate Control Wizard Cannot Be Used to Remove Groups or Users
http://support.microsoft.com/?kbid=229873

Author

Commented:
Many thanks for that.  I'll need to do some testing of this next week.
I had initially presumed the computer account would be allowed to edit its own AD description, though Effective Permissions then showed this not to be the case.  I also wasn't completely sure whether the script ran as Computer or as System.
I'll read up on the use of "Self" too and will be back in touch when I've tried it all out properly.

Author

Commented:
Sorry I left this unclosed so long.  Thanks for your help.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial