Creating Computer Accounts in Domain

Question

I'm getting "Access Denied" from domain accounts that have been granted the permission to join a specific computer account to the domain.

It seems to work ok in our testing lab, but not in production.

When we create the computer account, we are selecting a non-privileged account under the "User or group that can join the computer to domain" option.

There is no error during the computer account creation, but the attribute "adm-UserOrGroupThatCanJoinComputerToDomain" is not being set either. Not sure this is supposed to be visible or not....

Thanks

Answer 1

Hello,

Please open the Permissions dialog for the computer and make sure there are permissions for the user in that dialog.

Comments

The account that was assigned appears to have full permissions on the computer account.

---

Hello,

Sorry for the delay. The fact that the account has Full Control rights for the computer, means that the user must be able to join the computer to a domain. Our QA team will investigate the possible reasons for why the user receives the Access is Denied error. I'll update this post as soon as they get any results.

---

Thanks - we really need this functionality to work. I appreciate it.

---

I've attached some additional information and findings. It appears that ADAxes is not granting sufficient permission to fully add a computer account in our domain.

---

Also, I would point out that if I add at least the "Reset password" permission manually to the delegated account after creating it with ADAxes, the user is then able to add the computer to the domain.

---

Hello,

We managed to reproduce and fix the issue. The fix is available in the latest build of 2012.1. You can download it here. Upgrade Instructions.

Thank you very much for the bug report!

---

Fixed! Thanks for the quick turnaround. Whenever elegance in software design comes up, I mention your product. Not only for the support structure you have (this forum), but especially the ease with which updates can be applied without breaking the current installation. Many thanks and keep up the good work. Perhaps it will rub off on some other vendors out there....

---

Thank you for the good words :)

---

I'm having the same problem, when I look at the permissions the normal domain user has full control of the object created but we get this error when trying to join the computer to the domain with that user:

"Your computer could not be joined to the domain because the following error occurred: No mapping between account names and security ids was done."

Please let me know how I can correct this. Thanks!

---

Hello,

Please upgrade to the latest version of Adaxes. This must solve the problem. The latest version is 2012.1 (3.3.8218.0).

---

I upgraded and am still getting the same mapping error. Thanks!

---

We'll investigate the issue. For now, please

• ensure that you are using the correct user name\password combination when prompted for credentials to add the computer to the domain.
• ensure that you entered the correct DNS Domain name for domain you are trying to join.

---

OUr pre-2000 domain was MITEK, our 2003 domain is mii.com. I used it trying to add the computer and got a different message: Another computer in the domain is already using the specified computer name.

---

What is the exact text of the error message?

---

"Your computer was joined to the domain but using the old name because: Another computer inthe domain is already using the specified computer name"

I have verified there is only the one computer name and it is the one I created with the Adaxes Create Computer function. It did not use that one but create one with the previous specified computer name(not the one I specified when attempting to join it to the domain) in the root Computer OU.

I tried this again by unjoining it back to Workgroups, changed the name first to the name in Active Directory, restarted, then joined it to the domain. It worked fine doing it that way. Thanks!

---

Unfortunately our QA team cannot reproduce the error... Is it reproducible in your environment?