Machine object is already in AD

Question

Hi All ,

A task sequence completed imaging windows 10 machine but the machine didn't join the domain , looking at the netsetup log I found the following error:

problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

I'm sure the "domain join account" have sufficient permissions to create the machine object in the OU named "B" . but also I know this machine have an object in AD in a different OU "A" where the domain join account doesn't have permissions to.

I just don't understand , why the domain join account needs permissions to the OU where the machine currently exist "A" , why permissions to "B" is not enough?

Thanks

Answer 1

No, it won't be moved. It is reused, as is, and in-place.

If that's your intent, you need to implement an additional process to either move the account or delete it before the process begins to side-step your initial permissions issue also.

Answer 2

Because that's the way it works. If an object for the system already exists, then that object will be reused and thus the account used must have permissions on the existing object.

Answer 3

So when you say the machine object will be reused , do you mean it will be moved ?

so if I grant the domain join account a permission to the old OU , now I expect the machine object will be moved from old OU to the new OU ?