Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
A machine m that is a member of an Active Directory ___domain d has a corresponding object o in d's ___domain NC. The object o is called the machine account of the joined machine m. The objectClass attribute of o contains the class computer. In addition to objectClass, the following attributes of o are significant to the membership of m in d:
The syntax and other details of these attributes are documented in [MS-ADA1], [MS-ADA2], and [MS-ADA3].
The following predicates are satisfied by the joined machine m's state and the state of object o:
the ___domain d's NetBIOS name equals m.___domain-name.netbios
the ___domain d's fully qualified DNS name equals m.___domain-name.dns
o!userAccountControl & ADS_UF_WORKSTATION_TRUST_ACCOUNT ≠ 0
o!sAMAccountName equals m.machine-account-name
o!unicodePwd equals m.___domain-secret
o!msDs-supportedEncryptionTypes equals m.supported-encryption-types, in the format specified in [MS-KILE] section 2.2.7. Note that the msDs-supportedEncryptionTypes attribute is not supported on all products. In such cases, m.supported-encryption-types is set to NULL.
Section 6.1.1.2.1.1.4 specifies the representation of a ___domain's NetBIOS name. A ___domain's fully qualified DNS name is derived from the DN of its root object, as specified in section 3.1.1.1.5.
The specific choices made in implementing a machine joined to a ___domain (for example, for maintaining these variables) are outside the state model. Windows might periodically update m.___domain-secret on the client machine and o.___domain-secret in the Windows Active Directory. This behavior is not required for a functional ___domain join.