Computer Accounts in Visual C#

Create Code 39 Extended in Visual C# Computer Accounts

5

Be very clear on the differences among disabling, resetting, and deleting a computer account. What is the impact of each on the computer object, its SID and group membership, and on the system itself Know the four rules for troubleshooting computer account problems. Apply all four, every time, and you will be likely to nail every computer account troubleshooting question. Be comfortable with finding objects in Active Directory and managing those objects from the search results. This skill set applies to many objects in Active Directory, and several objectives of the certification exam.

computer account An account created in Active Directory that uniquely identifies the computer in the domain.

5-31

Page 5-11

1. What are the minimum credentials necessary to create a Windows Server 2003 computer account in an OU in a domain Consider all steps of the process. Assume Active Directory does not yet have an account for the computer. a. Domain Admins b. Enterprise Admins c. Administrators on a domain controller d. Account Operators on a domain controller e. Server Operators on a domain controller f. Account Operators on the server g. Server Operators on the server h. Administrators on the server

The correct answers are d and h. Account Operators on a domain controller are assigned the minimum permissions necessary to create a computer object in the domain. You must be a member of the local Administrators group on the server to change its domain membership.

2. Which locations allow you to change the domain membership of a computer running Windows Server 2003 a. The properties of My Computer b. Control Panel s System application c. Active Directory Users and Computers d. The Network Connections folder e. The Users application in Control Panel

3. What command-line tools will create a domain computer account in Active Directory a. Netdom b. Dsadd c. Dsget d. Netsh e. Nslookup

5-32

Page 5-17

5

1. What platforms are capable of joining a domain a. Windows 95 b. Windows NT 4 c. Windows 98 d. Windows 2000 e. Windows Me f. Windows XP g. Windows Server 2003

2. You open a computer object and, on the Operating System tab, discover that no properties are displayed. What causes these properties to be absent

A computer has not joined the domain using that account. When a system joins the domain, by default it populates the properties shown on the Operating System tab.

3. An executive has a laptop running Windows XP, with a machine name of TopDog. You want to allow the executive s laptop to join the domain, and you want to be sure that the computer is configured by the group policies linked to the Desktops OU immediately. How can you achieve this goal

Create a computer object in the Desktops OU for the TopDog computer. While creating the account, select the executive s user account for the property The Following User Or Group Can Join This Computer To A Domain.

4. Why is it a best practice to create a computer account in the domain prior to joining a machine to the domain

There are several reasons why it is a best practice to create a computer account in the domain prior to joining a machine to the domain. The first reason relates to the fact that if an account is not created in advance, one will be generated automatically when the computer joins the domain, and that account will be located in the default Computers container. The result is that computer policies, which are typically linked to specific OUs, will not apply to the newly joined computer. And, because most organizations do have specific OUs for computers, you are left with an extra step to remember: moving the computer object to the correct OU after joining the domain. Finally, by creating a computer object in advance, you can specify which groups (or users) are allowed to join a system to the domain with that account. In short, you have more flexibility and control during deployment.

Page 5-24