Active Directory: Everything About Computer Accounts

Explore how computer accounts authenticate to an active directory domain and how joining creates a domain account, with prestaging and up to 10 computers per domain for authenticated users.

This lab demonstrates joining two computers with different users, where Winton Dash signs in with a local user named site, then a domain user joins it to laptop's local domain.

Learn how to join a Windows 10 computer to a lab Active Directory domain by configuring IP and DNS, entering domain credentials, and verifying the new computer account.

Join a Windows computer to an Active Directory domain, create a user account, and verify the join by restarting and checking the domain controller DNS and computer accounts.

Sign in with the local administrator, then join the laptop to the domain. DNS locates the domain controller, after which a computer account is created in Active Directory.

Understand the distinguished name as an address referencing an object in Active Directory. Define it with dc, ou, and cn components from child to parent, separated by commas and dots.

Explore data stored in a computer account, including the computer name, password, and attributes shown via the attribute editor and advanced features; notice the dollar suffix on computer names.

Name computers in a domain with concise, meaningful 15-character limits; avoid all-numeric names, use abbreviations, and note NetBIOS and SAM up to 16 with a trailing dollar sign.

Discover how to manage computer accounts by disabling a computer when unused for security, rather than deleting it, so users cannot log on to the domain until re-enabled.

Reset a computer account to prevent use until a new computer with the same name joins the domain, breaking the trust relationship and requiring a domain rejoin.

Delete a computer account when it is no longer needed to rejoin the domain later or replace a named computer with a different os, then rejoin locally and update dns.

Edit a computer account via the properties page; the general tab accepts a description, the operating system cannot be changed, and you can assign groups for permissions and delegation.

Discover restoring a deleted computer account by enabling Active Directory recycle bin in DSAC and restoring from backup if recycle bin isn't enabled, then verify domain authentication.

Join a Linux computer to an Active Directory domain by configuring IP and DNS, setting hostname, and creating a computer account, then verify domain sign-in and secure dynamic updates.

Disjoin and rejoin a Linux computer to a domain by managing domain user permissions, computer accounts, and DNS records in Active Directory.

Configure an Apple computer to join an Active Directory domain by setting IP and DNS, specifying the domain controller, and completing the join in macOS system preferences.

Learn how to disjoin an Apple computer from a domain by selecting the domain, clicking unbind, and verifying the computer account record.

Diagnose and resolve common domain join errors by following a troubleshooting checklist, validating IP and DNS settings, firewall and network connectivity, and ensuring domain controller contact and proper DNS records.

Troubleshoot time drift between domain-joined clients and domain controllers, since Kerberos tolerates only five minutes of skew; use the time command to synchronize with a time server.

Explore why domain rejoin is needed after restoring a computer to an earlier snapshot, and why deleting a computer account can break services like Exchange.

Cloning operating systems creates duplicate SIDs and computer accounts, causing domain conflicts. Use sysprep to generalize, regenerate the computer SID, and safely join the domain without disrupting trust relations.

Check operating system hotfixes on clients and domain controllers to prevent domain join and authentication failures due to incompatibilities; Windows 7 and 2008 R2 joins may show errors yet complete.

Discover how the computer account password is stored in active directory and the registry, including the current password in Unicode attribute and the last 40 passwords in LMPWDHistory.

Explain how Group Policy manages computer account password changes in Active Directory, typically every 30 days, with two passwords and replication considerations that may necessitate rejoining.

Change the machine account quota in an active directory domain to enhance security, increasing from 10 to 50 for standard users, excluding administrators and account operators, via the attribute editor.

Configure who can join computers to the domain via group policy and delegation in Active Directory. Remove authenticated users, add trusted groups, and delegate computer join to allow approved accounts.

Delegate domain joining to trusted groups, separate client and server computer accounts into dedicated OUs, and stage accounts with admin-only creation for deployments via WTS or SCM.

Learn to bulk import and join computers to an Active Directory domain with a script that reads names from a text file, stages accounts, and joins them.

Learn how to perform offline domain join with Windows computers using Server 2008 R2, provisioning a computer account and joining an offline client on isolated networks or powered-off virtual machines.

Demonstrates offline domain join by provisioning a computer account and joining an offline virtual machine to the domain using a domain controller and command prompt.

Identify the tcp and udp ports that must be open on firewalls for a computer to join a domain, detailing minimal ports on domain controllers and additional required ports.

Discover trusting a computer account for delegation, letting a web server impersonate users to access files on a file server, and why unconstrained delegation risks credentials.

Detect inactive computer accounts in active directory by querying last logon timestamp and password changes; export results to csv and optionally disable them with a script.