"Access is Denied" when rejoining domain with thin client

  • Thread starter Thread starter jpbeard
  • Start date Start date
J

jpbeard

We have a bunch of Neoware thin clients we are flashing with a new
version of XPembedded. These machines are joined to the domain before
they are flashed, the image we are pushing is not joined to the domain
per Neoware's recommendation (as each time the unit is flashed a new
SID is created). Now when we try to rejoin the TC to the domain with
anything other than the domain Admin account is gives us an Access
Denied error. Things we have tried:

Unjoining the TC from the domain before flashing (this is very time
consuming and did not work)
Deleting the computer accounts from the domain after flashing and
before rejoining

My question is what permissions need to be enabled for a member of the
Domain Management group to be able to rejoin these computers?
 
We have a bunch of Neoware thin clients we are flashing with a new
version of XPembedded. These machines are joined to the domain before
they are flashed, the image we are pushing is not joined to the domain
per Neoware's recommendation (as each time the unit is flashed a new
SID is created). Now when we try to rejoin the TC to the domain with
anything other than the domain Admin account is gives us an Access
Denied error. Things we have tried:

Unjoining the TC from the domain before flashing (this is very time
consuming and did not work)
Deleting the computer accounts from the domain after flashing and
before rejoining

My question is what permissions need to be enabled for a member of the
Domain Management group to be able to rejoin these computers?
Click to expand...

Account Operators can join computers to the domain; or you
can grant EITHER that "right" or "permissions" in a specific
OU. (Right == domain in general; Permissions allow you to
grant it per OU.)

As long as the machines are not using the SAME SID (as each
other) I would definitely try the following:

RESET the computer account (rather than rejoin)

IF it works it is the "right way" to do it. If it doesn't then
you will likely just need to use the rejoin method.
 
Back
Top