Where are new computer accounts placed by default?
|
Very short post on a tip that some may find useful or have forgotten about over the years. Ever wanted to change the default container that a new user object or computer object is provisioned/created in Active Directory? Creating a new user object or joining a new computer to the domain will result in the object either ending up in default CN=Users,DC=domain,DC=local container or the CN=Computers,DC=domain,DC=local
container respectively. Often I find that I want the default location to be an Organisational Unit (OU) where I have already linked some group policy objects and these default locations are not great as they need some manual intervention after each object is created to ensure they end up in the correct OU from a GPO perspective. Some readers may also be used to Windows Small Business Server (SBS) handling this automation, putting objects into the SBSComputers or
SBSUsers paths. To set this up the steps are really easy; we just use the redirect command on any Windows Domain Controller to perform the action for the whole domain.
If you are wanting to set the default path for ‘User Objects’ then:
If you are wanting to set the default path for ‘Computer Objects’ then:
Tips:
A: By default, new user and computer accounts are put in the predefined AD Users and Computers containers. Microsoft created these containers for interoperability with Windows NT 4.0 domains. When you upgrade a Windows domain from NT 4.0 to Windows 2000, Dcpromo puts all existing user accounts in the Users AD container and all existing computer accounts in the Computers AD container. The
Users and Computers containers aren't AD organizational units (OUs), so you can't link OU-level Group Policy Objects (GPOs) to them. You can, however, subject objects in the Users and Computers containers to domain-level and site-level GPOs. If you want to use OU-level GPOs for your user and computer objects, you must create proper AD OUs. If you do so, it's a good practice to change the default location for new user and computer objects. Changing the default location can be handy when, for
example, you script the creation of AD accounts and you don't explicitly provide an AD location. To change the default location, use the Redirusr and Redircmp command-line utilities. To change the default location of new user accounts to an OU named usersou in the contoso.com domain, use following command. redirusr ou=usersou,dc=contoso,dc=com Before you run Redirusr or Redircmp you should make sure that the new default containers actually exist in AD. Also, to use Redirusr and Redircmp your domains must be at the Windows Server 2003 functional level—they can contain only Windows 2003 Domain Controllers (DCs), not Win2K or NT 4.0 DCs. When you change the default location, the DC with the PDC emulator Flexible Single-Master Operation role should be online. The default location changes are written to the wellKnownObjects attribute of the AD domain object on the PDC emulator. When you join a machine to the domain, by default it will be placed in the Computers container under the root of the domain. This can be undesirable, particularly if you want to apply distinct Group Policy to machines when they are initially joined to the domain. Fortunately, Active Directory lets you change the default location for new Computer accounts. The best way to make this
change is with the redircmp tool that is included with Windows Server. For example, to redirect new computers in the cohovines.com domain to an Organizational Unit called NewComputers, run this command: Under the covers, the redircmp tool updates an attribute of the domain NC head object called wellKnownObjects. The wellKnownObjects attribute contains a list of well known GUIDs and a distinguished name for each GUID. By using GUIDs, the path to an object can be dynamic without the
client needing to be aware of anything other than the GUID for the object it is searching for. In this case, the aa312825-7688-11d1-aded-00c04fd8d5cd GUID is how Active Directory keeps track of the default location for new computer objects. You can use a tool like LDP to look at the wellKnownObjects attribute of the domain as shown below: What are the default Windows accounts?The DefaultAccount, also known as the Default System Managed Account (DSMA), is a built-in account introduced in Windows 10 version 1607 and Windows Server 2016. The DSMA is a well-known user account type. It's a user neutral account that can be used to run processes that are either multi-user aware or user-agnostic.
Which of the following Active Directory containers are new computer accounts placed in by default?If you are creating a new Active Directory domain, the users and computers containers are the default locations for all new user accounts and non-domain-controller computer accounts in the domain.
What is a computer placed into by default when it is joined to a domain?In a default installation of an Active Directory domain, user, computer, and group accounts are put in CN=objectclass containers instead of a more desirable OU class container.
What is default OU in Active Directory?The Default Domain Controllers OU is just one OU present when Active Directory is first installed. This OU is used to organize and administer the domain's domain controllers. Over time, the domain administrator can create an infinite number of OUs for the domain, but having too many OUs might make management difficult.
|
