Active Directory Domain Services 2008 : Disable a Computer Object

3/20/2012 5:43:33 PM

Scenario/Problem: You need to prevent users on a particular computer from logging on to AD DS.

Solution: Disable a computer account by using the Windows interface or the command line.

To disable a computer object by using the Windows interface, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
3.	In the details pane, right-click the computer object you want to disable and click Disable Account.
4.	On the confirmation screen to disable the computer account, shown in Figure 1, click Yes. Figure 1. Disabling a computer object using the Windows interface.

To disable a computer object by using the command line, perform the following steps:

1.	Log on to a domain controller.
2.	Click Start, and click Command Prompt.
3.	In the Command Prompt window, type the following command and press Enter: Dsmod computer "CN=Desktop1,CN=Computers,DC=WS08DOMAIN01,DC=LOCAL" -disabled yes (where "CN=Desktop1,CN=Computers,DC=WS08DOMAIN01,DC=LOCAL" is the distinguished name of the computer that you want to disable).
4.	Verify that the results of the dsmod computer command entered above returns dsmod succeeded, as shown in Figure 2. Figure 2. Disabling a computer object using the command line.

Other -----------------