Recipe 8.7 Resetting a Computer

8.7.1 Problem

You want to reset a computer because its secure channel is failing.

8.7.2 Solution

8.7.2.1 Using a graphical user interface

1. Open the Active Directory Users and Computers snap-in.

2. If you need to change domains, right-click on Active Directory Users and Computers in the left pane, select Connect to Domain, enter the domain name, and click OK.

3. In the left pane, right-click on the domain and select Find.

4. Beside Find, select Computers.

5. Type the name of the computer and click Find Now.

6. In the Search Results, right-click on the computer and select Reset Account.

7. Click Yes to verify.

8. Click OK.

9. Rejoin computer to the domain.

8.7.2.2 Using a command-line interface

You can use the dsmod utility to reset a computer's password. You will need to rejoin the computer to the domain after doing this.

> dsmod computer  "<ComputerDN>" -reset

Another option is to use the netdom command, which can reset the computer so that you do not need to rejoin it to the domain:

> netdom reset <ComputerName> /Domain <DomainName> /UserO <UserUPN> /PasswordO *

8.7.2.3 Using VBScript

' This resets an existing computer object's password to initial default. ' You'll need to rejoin the computer after doing this. set objComputer = GetObject("LDAP://<ComputerDN>") objComputer.SetPassword "<ComputerName>"

8.7.3 Discussion

When you've identified that a computer's secure channel has failed, you'll need to reset the computer, which consists of setting the computer object password to the name of the computer. This is the default initial password for new computers. Every 30 days Windows 2000 and newer systems automatically change their passwords in the domain. After you've set the password, you'll need to rejoin the computer to the domain since it will no longer be able to communicate with a domain controller due to unsynchronized passwords. However, the netdom reset command will try to reset the password on both the computer and in Active Directory, which will not necessitate rejoining it to the domain if successful.

8.7.4 See Also

Recipe 8.3 for joining a computer to a domain, Recipe 8.6 for testing a secure channel, MS KB 216393 (Resetting Computer Accounts in Windows 2000 and Windows XP), and MS KB 325850 (HOW TO: Use Netdom.exe to Reset Machine Account Passwords of a Windows Server 2003 Domain Controller)