Computer Account Summary – Systems Engineering & Integration

A computer account is an Active Directory object that identifies a network computer. The account in Active Directory is associated with a specific hardware device. To identify a specific computer, two processes are required:

Create a computer account in Active Directory.
Join the computer to the domain.

You can perform these processes in the following ways:

Method	Description
Pre-stage accounts	Pre-stage a computer account to create the computer account in an OU. When the computer joins the domain, the computer is matched to the pre-staged computer account. Use this method to control the location of the computer account in Active Directory.
Manual join	From the computer you are adding to the domain, edit the System properties to join the domain. The computer contacts the domain controller and a computer account is created in Active Directory. When you join a domain and create a new computer account using this method, the computer account is added to the Computers built-in folder in Active Directory.
Redirection	Redirection puts computer accounts normally created in the Computers container into a specified OU. To redirect, enter the redircmp command and OU name at the command prompt. Make sure you are in the C:\Windows\System32 directory. For example, to redirect a computer to an OU named Desktops in Northsim.com, enter the following at the command prompt: redircmp OU=Desktops,DC=northsim,DC=com
Offline domain join	During the domain join process, the workstation must communicate with a domain controller. In situations where a network connection does not exist, you can use the offline domain join feature to join the computer to the domain. To perform an offline join, use Djoin as follows: Enter Djoin /provision on a computer that can communicate with a domain controller (this computer is called the provisioning computer). This process: Creates the computer account Generates a text file, referred to as the blob file. Copy the blob file to the computer that you want to join to the domain. Run Djoin /requestODJ to insert the file into the Windows directory. Reboot the computer to join it to the domain. You can also use an Unattend.xml file and the blob file during installation to join the computer to the domain during the install process. You can run Djoin only on a computer running Windows Server 2008 R2 and later or Windows 7 and later. By default, Djoin contacts a domain controller running Windows Server 2008 R2 or later, but you can run Djoin with the /downlevel parameter to communicate with a pre-Windows 2008 R2 domain controller.

Be aware of the following facts about computer accounts and joining a domain:

The members of the following groups can create a computer account:
- Account Operators
- Domain Admins
- Enterprise Admins
After a computer account is created, you must join the computer to the domain before the computer receives Group Policy settings or before Active Directory receives workstation-specific information.
To join a computer to a domain, you must be a member of the Administrators group on the local computer or be given the necessary rights.
Use the dsadd and netdom utilities to join a domain from the command line as follows:
- Use dsadd to create a computer account.
- Use netdom to rename a computer account.
- Use netdom join to join a computer to a domain.

Each computer has a password that is automatically generated when the computer joins the domain.

When the computer boots, this password is used to authenticate the computer to the domain and establish a secure channel between the computer and the domain controller.
The password is saved on the local computer and in Active Directory. By default, the password is changed automatically every 30 days.
If the two passwords become unsynchronized, the computer will not be able to connect to the domain. An error indicating that the computer failed to authenticate is generated. This problem will occur if you have turned off the computer for an extended period, rebuilt the computer, or if you are replacing the computer with another one using the same computer account name.
When computer logon fails, reset the computer account using one of the following methods:
- Run the netdom reset command followed by the computer account name and the domain.
- In Active Directory Users and Computers, right-click the computer account and select Reset Account.

After resetting the computer account, you must rejoin the computer to the domain.