Managing Computer Accounts

Microsoft® Windows® 2000 Scripting Guide

In Active Directory, computers are security principals, just like users. This means that computers must also have accounts and passwords, just like other security principals. To be fully authenticated by Active Directory, a user must not only have a valid user account, but he or she must also log on to the domain from a computer that has a valid computer account. If a user attempts to log on from an unauthorized computer, authentication will fail and the user will be denied access to important Active Directory capabilities such as Group Policy, roaming user profiles, remote installation, Quality of Service (QoS) networking, DNS, and applications that use Active Directory as a data store.

You cannot create computer accounts for computers running Microsoft® Windows® 95, Microsoft® Windows® 98, Microsoft® Windows® Millennium Edition, and Microsoft® Windows® XP Home Edition because these operating systems do not adhere to Active Directory security requirements. As a result, computers running these operating systems cannot join a domain, and users logging on from these computers will not have access to the complete range of Active Directory resources and services.

Attributes of an Active Directory Computer Account

Each computer account in Active Directory is an instance of the Computer class. This class has six mandatory attributes. (Attributes are also referred to as properties.) Mandatory attributes are properties that each account must have; you cannot create a computer account in Active Directory unless that account has each of the following attributes:

• Common-Name

• SAM-Account-Name

• Instance-Type

• NT-Security-Descriptor

• Object-Category

• Object-Class

Note

• When you create a computer account, you need to specify that the account is for a computer and provide the Common-Name and the SAM-Account-Name. The other mandatory attributes will automatically be created for you.

In addition to the six mandatory attributes, the Computer class has scores of optional attributes that are inherited from the User class. These attributes vary in usefulness. Some, such as computer location, are extremely useful to administrators; by configuring the computer location attribute, administrators can use Active Directory as a way to identify the physical location of every computer in the organization.

Other attributes are meaningless when applied to a computer; for example, computers do not have user profile paths or home phone numbers (although Active Directory does not prevent you from assigning a user profile path or a home phone number to a computer). Although these might seem nonsensical, the Computer class possesses these attributes simply because the class was derived from the User class. As such, the Computer class inherited all the attributes found in the User class.

A subset of the attributes useful for working with computer accounts are listed in Table 9.1. All of these attributes are available after the computer account has been created.

Table 9.1 Attributes of the ADSI Active Directory Computer Account