Create Computer object

Question

I'm trying to get the function to let a normal user join a computer to the domain by using the Create Computer command in Adaxes. The task I want to fulful is to let a helpdesk user create a computer in AD and set the option "User or group that can join the computer to domain.." to a normal user to let that user join his/hers computer to the domain using the name specified by helpdesk.
The problem is that the helpdesk user can successfully add the computer object and assign the end user that will join it, but when the end user tries to join the domain windows gives the error:
"The join operation was not successful.. .access is denied."

Anyone that knows what I'm missing?

Comments

Hello Niclas,

Can you answer the following questions to troubleshoot the issue:

1. What version of Adaxes are you using?
2. What operating system is running on the computer where Adaxes is installed?
3. What is the functional level of your AD domain? For information on how to get it, see below.
4. Does this happen with every computer created by the helpdesk or only with some of them?
5. Have there ever existed a computer with the same name in your domain before? Maybe, you are reusing standard names for your computers?

How get the functional level of your AD domain:

1. Right-click your domain in the Administration Console and select Properties.
   
2. The functional level will be displayed on the General tab.
   

---

Hello,

See answers below.

Can you answer the following questions to troubleshoot the issue:

1. What version of Adaxes are you using? 3.7.11218.0
2. What operating system is running on the computer where Adaxes is installed? Server 2012
3. What is the functional level of your AD domain? For information on how to get it, see below. Forest and dom level are 2012
4. Does this happen with every computer created by the helpdesk or only with some of them? Have tested with three names. All the same error
5. Have there ever existed a computer with the same name in your domain before? Maybe, you are reusing standard names for your computers? Both reused and new names

---

Niclas,

Can you answer one more question? Is the issue reproduced if you try doing the same using Active Directory Users and Computers (ADUC)?

---

I'm not sure how I should do that test? Normal users doesn't have the "User Rights Assignment - Add computers to domain" right.
Do I need to set special permission on the computer object to test?

---

Hello Niclas,

We mean that you need to create a computer account using ADUC and specify who can join the account to the domain. When performing the task, use the account that was used to register your AD domain in Adaxes. Then, try joining the new computer to the domain.

Also, can you have a look at Adaxes Event Log for any errors and/or warnings related to inability to modify AD security settings of the new computer objects. For information on how to access the Event Log, see the following help article: http://www.adaxes.com/help/?ServiceAdmi ... ntLog.html.

Answer 1

A little wierd, but now it actually works fine. The only thing I know is that the Adaxes server has been rebooted once between the tries. But case closed. :D

Comments

Hello Niclas,

Thanks for the update!