Solved

GPO - Disable computer object that has not checked into network for 90 days.

Posted on 2014-09-10
6
320 Views
Last Modified: 2014-09-19
Hi Experts,
The client we support  requested we create a GPO that disables computer objects that hasn't checked into domain for more than 90 days, something that we missed during the initial consideration for this was our workstation build engineers who build several machines and holds them in stock ready to be distributed when required, unfortunately when they send out machines to some of these has now surpassed the 90 days, and the results is the computer object is disabled, is there any way we can work around this, we cannot change the policy, but just ideas on a better process for the engineers building these machines, thoughts?
0
Comment
Question by:craigleenz
  • 2
  • 2
  • 2
6 Comments
 
LVL 28

Expert Comment

by:becraig
ID: 40315791
Simply group all your newly built workstations in their own OU and exclude that OU from the GPO.
0
 

Author Comment

by:craigleenz
ID: 40315818
thanks becraig, that's definitely an idea, then once the machine is ready to be deployed, the engineer just move the machine to the correct OU?
0
 
LVL 28

Accepted Solution

by:
becraig earned 250 total points
ID: 40315829
Yup So that way your current GPO to disable any computer objects not logged in will not apply.

However do remember the tombstone lifetime for AD objects:
you can verify this before you proceed:
To absolutely know, follow this procedure on your Windows 2008 domain controller:

1. Click Start, point to Administrative Tools, and then click ADSI Edit.
2. In ADSI Edit, right-click ADSI Edit, and then click Connect to.
3. For Connection Point, click Select a well known Naming Context, and then click Configuration.
4. If you want to connect to a different domain controller, for Computer, click Select or type a domain or server: (Server | Domain [:port]). Provide the server name or the domain name and Lightweight Directory Access Protocol (LDAP) port (389), and then click OK.
5. Double-click Configuration, CN=Configuration,DC=ForestRootDomainName, CN=Services, and CN=Windows NT.
6. Right-click CN=Directory Service, and then click Properties.
7. In the Attribute column, click tombstoneLifetime.
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 90

Assisted Solution

by:John Hurst
John Hurst earned 250 total points
ID: 40316106
there any way we can work around this, we cannot change the policy,

Alternatively, consider this to be a business question and save yourself some work. Require engineers building machines to have a "bring forward" to start them every 75 days. I do not think this should be onerous or hard if the reason why is explained.

Otherwise they have to identify to you when to change groups. The second is more work for you and no easier than the first.
0
 

Author Closing Comment

by:craigleenz
ID: 40331929
thanks,
0
 
LVL 90

Expert Comment

by:John Hurst
ID: 40332284
@craigleenz  - You are very welcome and I was happy to help.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Driver Problem 12 62
Tools to Output documents from DB based on selections 8 85
Burning ISO Win/Mac 21 44
PCAnywhere 2 58
Finding a job can be stressful - searches, resume tweaks, and networking events can be super boring. Luckily we're here to help you land your dream job!
Let’s list some of the technologies that enable smooth teleworking. 
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now