Lesson 1: Creating Computers and Joining the Domain in VS .NET

Drawer USS Code 128 in VS .NET Lesson 1: Creating Computers and Joining the Domain

The default configuration of Windows Server 2008 as well as of Microsoft Windows Server 2003, Windows Vista, Windows XP, and Windows 2000 is that the computer belongs to a workgroup. Before you can log on to a computer with a domain account, that computer must belong to the domain. To join the domain, the computer must have an account in the domain which, like a user account, includes a logon name (sAMAccountName), a password, and a security identifier (SID) that uniquely represent the computer as a security principal in the domain. Those credentials enable the computer to authenticate against the domain and to create a secure relationship that then enables users to log on to the system with domain accounts. In this lesson, you will learn the steps to prepare the domain for a new computer account, and you will explore the process through which a computer joins the domain.

After this lesson, you will be able to: Design an OU structure for computers. Create computer objects in the domain. Delegate the creation of computer objects. Join computers to the domain. Redirect the default computer container. Prevent nonadministrative users from creating computers and joining the domain. Estimated lesson time: 45 minutes

In a workgroup, each system maintains an identity store of user and group accounts against which users can be authenticated and access can begin. The local identity store on each computer is called the Security Accounts Manager (SAM) database. If a user logs on to a workgroup computer, the system authenticates the user against its local SAM database. If a user connects to another system, to access a file for example, the user is re-authenticated against the identity store of the remote system. From a security perspective, a workgroup computer is, for all intents and purposes, a standalone system. When a computer joins a domain, it delegates the task of authenticating users to the domain. Although the computer continues to maintain its SAM database to support local user and group accounts, user accounts will typically be created in the central domain directory. When a user logs on to the computer with a domain account, the user is now authenticated by a domain controller rather than by the SAM. Said another way, the computer now trusts another authority to validate a user s identity. Trust relationships are generally discussed in the context of two domains, as you will learn in 12, Domains and Forests, but there is also a trust between each domain member computer and its domain that is established when the computer joins the domain.

5

Three things are required for you to join a computer to an Active Directory domain:

A computer object must be created in the directory service. You must have appropriate permissions to the computer object. The permissions allow you to join a computer with the same name as the object to the domain. You must be a member of the local Administrators group on the computer to change its domain or workgroup membership.

Before you create a computer object in the directory service the first of the three requirements for joining a computer to the domain you must have a place to put it. When you create a domain, the Computers container is created by default (CN=Computers, . . .). This container is not an organizational unit (OU); it is an object of class container. There are subtle but important differences between a container and an OU. You cannot create an OU within a container, so you cannot subdivide the Computers OU, and you cannot link a Group Policy object to a container. Therefore, it is highly recommended to create custom OUs to host computer objects instead of using the Computers container.