Managing OUs, Users, and Groups in Active Directory

This chapter is from the book

Inside Active Directory: A System Administrator's Guide

Learn More Buy

This chapter is from the book

This chapter is from the book 

Inside Active Directory: A System Administrator's Guide

Learn More Buy

Administering Computer Objects

Just as Active Directory has a user object for each network user, it has a computer object for each computer in the domain. However, this applies "only" to Windows 2000 and Windows NT computers. Other workstations (e.g., Windows 95 and 98 and non-Microsoft operating systems) that are not using the NT-based integrated security cannot have a computer object.

Also, computer objects are used only for computers that join a domain. If a stand-alone server or workstation will be in a workgroup instead of a domain, it will not be assigned a computer object in Active Directory.

You could categorize computer object properties as either significant or informational, just as we did with user objects. However, the distinction among computer objects is not as clear as it is among user objects, so we don't use these terms with computer objects in this book (short of a couple of exceptions).

The purposes of computer objects are as follows:

• As inherited from the very first version of Windows NT back in 1993, a computer account ties the workstation or server to the Windows NT/2000 security model.

• A computer object is a placeholder for properties that help you when you are remotely installing and managing workstations.

• A computer object is a placeholder for properties that are purely informational.

• A computer object is a security principal. This means that just as with a user, you can give permissions for resources and assign security group memberships to the computer.

• The location of a computer object in Active Directory dictates which group policies apply to the corresponding computer.

Computer objects are treated slightly differently, depending on whether they are for domain controllers or for workstations and member servers. Table 3.14 compares the two.

When you start to manage computer objects, your tasks will include the following:

• Create computer objects.

• Set computer object properties.

• Move, rename, disable, reset, and delete computer objects.

• Assign Group Policy and permissions, and delegate administrative tasks.

In this chapter, we focus on the first three items in the list. The last item is discussed in later chapters. If you want to try the management tasks discussed in this section, you can create some test computer objects in your test OU. To test all the features, however, you will need some test workstations.

Creating Computer Objects

As Table 3.14 in the previous section implies, computer objects are created in three ways.

TABLE 3.14 Comparing Domain Controllers and Other Computer Objects

• A computer object for a domain controller is created automatically in the Domain Controllers OU when you install Active Directory on that server by running the Active Directory Installation Wizard (i.e., DCPromo).

• When you join a stand-alone server or workstation to a domain, either during computer installation or afterward, you have the option to create the computer object. An object created in this way goes to the Computers container.

• You precreate the computer object manually using the Users and Computers snap-in. This choice is explained next.

You can store the computer objects either in the Computers container or in various OUs in the domain. The latter option allows different OU-based group policies for different computers.

When you right-click the appropriate target OU and select New, Computer, you will see the dialog box shown in Figure 3.17. Here you specify the name for the object, the downlevel name for the computer, and the user or group who can later join the computer to the domain.

Figure 3.17 When you create a computer object, you are prompted to specify the name for the object, the downlevel name for the computer, and the user or group who can later join the computer to the domain. If the joining computer is running Windows NT, you must select the bottom check box.

If you use Remote Installation Services (RIS) to install Windows 2000 Professional computers, there will be one or two additional pages in the creation wizard. Figure 3.18 shows the first of these pages.

Figure 3.18 If you use RIS, you will see a second page in the creation wizard. You can specify that this is a "managed computer" and enter the computer's GUID.

Computer manufacturers assign a unique GUID to each computer they sell. If you enter this GUID into Active Directory, it will help RIS match a certain computer system to a certain computer object.

After you have bought a computer and turned it on for the first time to install Windows 2000 Professional onto it, the RIS service sends the computer's GUID to a RIS server. This way, RIS can locate the correct computer object in Active Directory.

If you selected the "This is a managed computer" option on the wizard's second page, you will see one more page, which is shown in Figure 3.19.

Figure 3.19 If you selected the "This is a managed computer" option in the creation wizard's second page (Figure 3.18), you will see another page that enables you to specify a certain remote installation server. You can use this for load balancing, so that certain client computers (identified by the GUID) install Windows 2000 Professional from a certain server.

A computer object has several names, which are listed in Table 3.15.

TABLE 3.15 Name Properties of a Computer Object

Setting Computer Object Properties

The Users and Computers snap-in shows you about 15 computer object properties, and you can set about 8 of them. Behind the scenes, a computer object may have 228 properties.

Table 3.16 lists the properties in five of the six tabs. We discuss the sixth tab, Member Of, later in this chapter in the "Administering Groups" section. We don't include screen shots, because they would show just a number of text boxes. Many of the setting names are self-explanatory. Note that Windows 2000 also provides context-sensitive help for each of the settings.

TABLE 3.16 Properties of a Computer Object

Other Operations to Manage Computer Objects

Other operations you can do to manipulate computer objects are move, delete, disable, and reset. You can also rename computers or start computer management to manage the computer corresponding to the object.

Moving Computer Objects

If you need to move a computer object from one OU to another, you do it in the same way you move users. When you are moving a computer within a domain, you right-click the computer object and select Move. Then you choose the destination and click OK. Between domains in a forest you use the Support Tools command-line tool MoveTree, which is discussed in Chapter 6.

You can move several sibling objects at once by selecting them in the right-hand pane of the snap-in by using the Shift and/or the Ctrl key.

When you move computer objects

• Permissions that are assigned for the object being moved move with the object.

• Group policies and permissions that are inherited from above do not move with the object being moved. Instead, the moved object inherits the policies and permissions from its new location.

Deleting Computer Objects

You delete an object by right-clicking it and selecting Delete or by selecting the object and pressing the Delete key. Because there is no Undo option, a safety mechanism asks you to confirm the deletion.

A computer object is a security principal like a user object. Therefore, if you delete a computer object and then recreate it, the new object doesn't have the memberships or permissions of the old one.

If you delete a computer object, the corresponding computer is no longer part of the domain. Therefore, no one can log on to the computer using a domain user account.

Disabling Computer Accounts

You can disable the computer account by right-clicking the computer object and selecting Disable Account. Doing so will prevent users sitting at that computer from logging on using a domain user account.

You cannot disable a domain controller.

Resetting Computer Accounts

When a Windows 2000 (or Windows NT) computer that is a member of a domain starts, the computer logs on to the domain using the computer account and some password known to the machine. After this, a user sitting at the computer can enter his username and password to log on to the domain.

The aforementioned machine logon sets up a secure channel, which enables the member computer to communicate with a domain controller to exchange user and password information. For example, if the computer account password stored in the local computer (called LSA secret) doesn't match the one stored in Active Directory, authentication to the domain is not possible and the user will receive an error like the one shown in Figure 3.20.

Figure 3.20 If the member computer cannot establish a secure channel with a domain controller, the user receives an error message and is not able to log on using a domain user account.

An administrator can solve the problem by using the Reset Account context menu item on the corresponding computer object. Resetting a computer account resets its password to the initial value, which is "computername$" (without quotes). In addition, the member computer must be joined to a workgroup and then joined to the domain again.

Managing Computers

When you right-click the computer object and select Manage, the Computer Management snap-in starts and sets the focus to the corresponding computer. This way you can manage its system tools, storage, server applications, and services.

Renaming Computers

You rename a Windows 2000 workstation or member server using the Control Panel of that computer. Select System, then the Network Identification tab, and finally the Properties button. Once you enter a new name and click OK, you are prompted for the name of a domain user who has permission to change the name of the workstation or member server, as well as that user's password.

This operation renames the computer (i.e., the NetBIOS name and DNS name) and changes the pre–Windows 2000 name of the computer object. However, the object's common name doesn't change and you cannot change it using the Users and Computers snap-in. Instead, you must use ADSI Edit, which is part of Support Tools.