Securing Computers and Active Directory - Resetting a Computer Account

Problem

You want to reset a computer because its secure channel is failing.

Solution

Using a graphical user interface

1. Open the ADUC snap-in.
   
2. If you need to change domains, right-click on Active Directory Users and Computers in the left pane, select “Connect to Domain,” enter the domain name, and click OK.
   
3. In the left pane, right-click on the domain and select Find.
   
4. Beside Find, select Computers.
   
5. Type the name of the computer and click Find Now.
   
6. In the Search Results, right-click on the computer and select Reset Account.
   
7. Click Yes to verify.
   
8. Click OK.
   
9. Rejoin the computer to the domain.

Using a command-line interface

You can use the DSMod utility to reset a computer’s password. You will need to rejoin the computer to the domain after doing this.

  > dsmod computer "<ComputerDN>" -reset

Another option is to use thenetdomcommand, which can reset the secure channel between the computer and the domain controller without affecting the computer’s password, so that you do not need to rejoin it to the domain:

  > netdom reset <ComputerName> /Domain <DomainName> /UserO <UserUPN> /PasswordO *

You can also use thenltest command to reset a secure channel using the following syntax:

  > nltest /sc_reset:<DomainName>\<DCName>

Using VBScript

  ' This resets an existing computer object's password to initial default.
  ' You'll need to rejoin the computer after doing this.
  set objComputer = GetObject(LDAP://<ComputerDN>")
  objComputer.SetPassword "<ComputerName>"

Discussion

When you’ve identified that a computer’s secure channel has failed, you’ll need to reset the computer object, which consists of setting the computer object password to the name of the computer. This is the default initial password for new computers. Every 30 days, Windows 2000 and newer systems automatically change their passwords in the domain. After you’ve set the password, you’ll need to rejoin the computer to the domain since it will no longer be able to communicate with a domain controller due to unsynchronized passwords. However, the netdom reset command will try to reset the password on both the computer and in Active Directory, which will not necessitate rejoining it to the domain if successful.

From a practical standpoint, you should first attempt to reset the secure channel between the computer and the domain using thenetdomornltestsyntaxes, since doing so will not require you to unjoin and rejoin the computer to the domain; in particular, this will save you from performing the associated reboots involved with rejoining the domain. If resetting the secure channel does not correct the issue you’re facing, you can then resort to resetting the computer’s password.

See Also

Recipe 8.3 for joining a computer to a domain, Recipe 8.8 for testing a secure channel, MS KB 216393 (Resetting Computer Accounts in Windows 2000 and Windows XP), and MS KB 325850 (How to Use Netdom.exe to Reset Machine Account Passwords of a Windows Server 2003 Domain Controller)

Next: Finding Inactive or Unused Computers >>
 

More Windows Scripting Articles
More By O'Reilly Media

Comments On: Securing Computers and Active Directory

· This article is an excerpt from the book "Active Directory Cookbook, Second...   >>> Post your comment now!

Buy this book...

This article is excerpted from chapter eight of the Active Directory Cookbook, Second Edition, written by Robbie Allen and Laura E. Hunter (O'Reilly; ISBN: 059610202X). Check it out today at your favorite bookstore. Buy this book now.