Active Directory Cookbook

8.2. Creating a Computer for a Specific User or Group

Problem

You want to create a computer account for a specific user or group to join to the domain. This requires setting permissions on the computer account so the user or group can modify certain attributes.

Solution

Using a graphical user interface

1. Open the Active Directory Users and Computers snap-in.

2. If you need to change domains, right-click on Active Directory Users and Computers in the left pane, select Connect to Domain, enter the domain name, and click OK.

3. In the left pane, browse to the parent container for the computer, right-click on it, and select New → Computer.

4. Enter the name of the computer.

5. Click the Change button.

6. Use the Object Picker to select a user or group to join the computer to the domain.

7. Click OK.

Using a command-line interface

In the following solution, replace <ComputerDN> with the distinguished name of the computer object and <UserOrGroup> with the user principal name or NT-style name of a user or group you want to manage the computer:

> dsadd computer <ComputerDN>
> dsacls <ComputerDN> /G <UserOrGroup>:CALCGRSDDTRC;;
> dsacls <ComputerDN> /G <UserOrGroup>:WP;description;
> dsacls <ComputerDN> /G <UserOrGroup>:WP;sAMAccountName;
> dsacls <ComputerDN> /G <UserOrGroup>:WP;displayName;
> dsacls <ComputerDN> /G <UserOrGroup>:WP;"Logon Information";
> dsacls <ComputerDN> /G <UserOrGroup>:WP;"Account Restrictions";
> dsacls <ComputerDN> /G <UserOrGroup>:WS;"Validated write to service principal[RETURN] name"; > dsacls ...