BDD 2007 -How to ensure the computer is in the correct OU
As promised in a previous blog post here is a script to move a computer to the correct OU from within the host operating system.
There are two situations where I find this script useful:
- When a computer object already exists in Active Directory for the computer you are deploying. In this situation the existing computer object will be reused and the computer will remain in the original computer objects OU.
- When you are using a Staging OU during deployment. In this situation the computer is added to a staging OU when it is joined to the domain.
In both of these situations I want to ensure that the computer is in the correct OU when the deployment is finished.
To implement the script follow the steps detailed below:
Update the deployment point rules
The script uses the MACHINEOBJECTOU property specified using BDD rules to determine the OU that the computer object should be moved too. You will need to ensure that your rules specify a value for this property for each computer.
The following properties to be declared in the deployment point rules. These properties are used to connect to AD and move the computers. The account used must have the rights to create and delete computer objects in the domain:
DomainAdminDomain
DomainAdminPassword
DomainAdmin
Update the scripts folder
Next you must add the script to the .\distribution\scripts folder. You will notice that the script names have the prefix "Z-" this is because BDD automatically copies all scripts that start with "Z" from the distribution share to other deployment points when they are updated.
Update the build task sequence
The next thing you do is add the scripts to the build task sequence. I would recommend creating an application for each script that executes a script and then add it to the task sequence as shown below. it is important to note that the "Move Computer" task is run near the end of the State Restore phase, particularly if you are moving the computer from a staging OU.
Update your deployment points
Finally you should update your deployment points to so that these changes are propagated to the correct places.
If you want to see how to move the computer to a staging OU from within windows PE then refer to my previous blog post.
Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in the Terms of Use .
Comments
Anonymous
January 01, 2003
If you are using GPOs in your Active Directory Environment you can come into a situation during yourAnonymous
January 01, 2003
PingBack from http://blogs.technet.com/benhunter/archive/2007/09/16/bdd-2007-how-to-move-a-computer-object-in-windows-pe.aspxAnonymous
January 01, 2003
I have not tried to do this before. But I know it has the DC used to join in the netsetup.log file. You could get the information from there and then use it in your script. Thanks, BenAnonymous
January 01, 2003
Hi Ben, Quick question on this one. Why can't you just edit the unattend.txt for each particular task sequence? Under the Identification header I have edied my MachineObjectOU and it is working. Just trying to determine if it's necessary to change at this point, since I have it working now in my environment. In any case, good stuff! RichAnonymous
January 01, 2003
Hi Rich, You can edit the unattend.txt file and it will work. If for some reason you want to override this value then you can add it to the CS.ini and MDT will update the unattend.txt for you. Thanks, BenAnonymous
January 01, 2003
The comment has been removedAnonymous
January 01, 2003
Generally that error means that there is something wrong with your AD connection. You have have to add some more logging to the script to determine why. Thanks, BenAnonymous
October 08, 2007
Excellent as always! Thanks for taking the time to write it upAnonymous
October 09, 2007
We're having problems just joing the domain by adding the information to the Specialize section Windows-Setup-UnattendJoin section. Is this a known issue? We have not created a custom WIM image yet. Just using BDD to push out an unattended install of Vista Enterprise.Anonymous
October 18, 2007
Great script Ben, I've done something similar in the past, and the only issue we had is that the occasionaly the script would connect to a different DC than the one that was used for the domain join. If the DCs were in different sites, and replication had not occured by the time the Move OU script runs .. it can't find the Computer object to move. Do you know of any method of determining which DC was used by the client for the Domain Join? If so we could then target the script to the same DC.Anonymous
November 23, 2007
Hello Ben, I now recieve an error after processing Move computer routin in the Z-MoveComputer_StagingOU.log Unhandled error returnd by Z-Movecomputer_StagingOU: Table does not exist. (-2147217865) etc. any idea what this could be?