Understanding Computer Accounts

Applies To: Windows Server 2008

Every computer running Windows NT, Windows 2000, Windows XP, or Windows Vista or a server running Windows Server 2003 or Windows Server 2008 that joins a domain has a computer account. Like user accounts, computer accounts provide a means for authenticating and auditing access to the network and to domain resources. Each computer account must be unique.

You can add, disable, reset, and delete user and computer accounts with Active Directory Users and Computers. You can also create a computer account when you join a computer to a domain.

When the domain functional level is set to Windows Server 2008, a new lastLogonTimestamp attribute is used to track the last logon time of a user or computer account. This attribute is replicated within the domain, and it can provide you with important information regarding the history of a user or computer.

Understanding computer names

Each computer account that is created in Active Directory Domain Services (AD DS) has a relative distinguished name, a pre–Windows 2000 computer name (Security Accounts Manager (SAM) account name), a primary Domain Name System (DNS) suffix, a DNS host name, and a service principal name (SPN). The administrator enters the computer name when he or she creates the computer account. This computer name is used as the Lightweight Directory Access Protocol (LDAP) relative distinguished name.

AD DS suggests the pre–Windows 2000 name using the first 15 bytes of the relative distinguished name. The administrator can change the pre–Windows 2000 name at any time.

The DNS name for a host is called a full computer name. This is a DNS fully qualified domain name (FQDN). The full computer name is a concatenation of the computer name (the first 15 bytes of the SAM account name of the computer account without the "$" character) and the primary DNS suffix (the DNS domain name of the domain in which the computer account exists). This name is listed on the Computer Name tab in System Properties in Control Panel.

By default, the primary DNS suffix portion of the FQDN for a computer must be the same as the name of the Active Directory domain where the computer is located. To allow different primary DNS suffixes, a domain administrator may build a restricted list of allowed suffixes by creating the msDS-AllowedDNSSuffixes attribute in the domain object container. The domain administrator creates and manages this attribute with Active Directory Service Interfaces (ADSI) or LDAP.

The SPN is a multivalue attribute. It is usually built from the DNS name of the host. The SPN is used in the process of mutual authentication between the client and the server hosting a particular service. The client finds a computer account based on the SPN of the service to which it is trying to connect. Members of the Domain Admins group can modify the SPN.