Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been playing around with windows server and Active directory for quite some time. One can simply add a new user in AD and then add the client to the domain. this will create a domain account for the user.

I wonder what is the need to add computers to the domain in the server manager? Why adding a user to the domain is not enough?

I have searched on this topic but all the references talk about how to but I am looking for why to?

share|improve this question
up vote 1 down vote accepted

You put computers in AD for the same reason you put people in AD: Management and security.

You add users to your domain to give them access to different resources, but also to control their access. The same thing goes for computers. Just as you dont allow just anyone to log into the domain, you do not allow any computer access either.

Look in group policy, you will see just as much management criteria for computer as people. You can learn a lot just looking at the controls you have.

share|improve this answer
what if the computer and user both have different set of security policy associated with them? which of them gets priority – Shurmajee Mar 27 '13 at 4:14
restrictions always take precedence. – Keltari Mar 27 '13 at 12:02

You join computers to the domain for centralized management. It enables you to use other Microsoft services, such as Group Policy (with per computer settings) and WSUS. Also, if a computer is joined onto a domain, any domain user can login to it while connected to the network.

Group Policy is extremely useful, in itself, as you can tweak very nearly every setting on a Windows computer (or group of computers, or all your computers) through it.

share|improve this answer
if i am adding a user to a domain then some other user of the domain can also login to the domain through that computer, Without really adding that computer – Shurmajee Mar 27 '13 at 4:17

While centralized security is nice for management, the answer I would give is it provides a common security context. Effectively when the computer is joined to a domain it is allowed to access whatever it feels like limited to its permissions. If the computer is not joined to the domain, you have to verify your security context every time you have to access a domain resource. This is a result of it not being part of the Kerberos realm by default. There are a certain level of hacks around this but the common security context that being in a common realm\domain provide do not seem like something you want to hack around.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .