Imaging and AD process

[rocknrollstar]

Hi, I am in the process of imaging several (24) computers at our school. I've got a FOG server running, and it's all works fine. Environment is Win2k server, xp clients.

 

My question is about using AD. The computers are all currently registered in AD (on the domain). What's the process that I need to do to reimage them, but have them joined to the domain and in an OU when they get imaged? Do I need to remove it from the domain before doing any imaging?

 

I'm using sysprep, and have got it to join the domain automatically, although it gives it a rubish name (eg domain-234k234). Not sure if I need Fog to do any AD stuff.

 

I.E. is this right?

 

1- remove from domain

2- have sysprep add to domain, including special naming convention

3- deploy image

 

Also, how do I use sysprep, but join different machines to different OUs?

 

Sorry for the confused post, got to go to a funeral soon and trying to get it completed! Thanks in advance.

[dwhyte85]

The simplest method would be:

 

If you're using an image to put onto machines, it would be already off the domain. When you image a machine it doesnt matter whether they're on/off the domain, it might be worthwhile deleting the computer account from AD if you want to be careful.

 

When you've finished imaging, use a tool called NewSID, this will ensure your machines wont give funny errors for dup SIDs.

 

When you've finished SID'ing, rejoin the computer to the domain and rename the computer accordingly, then put in correct OU.

[powdarrmonkey]

When you've finished imaging, use a tool called NewSID, this will ensure your machines wont give funny errors for dup SIDs.

 

Noononono. Sysprep exists for a reason; if you're going to image, at least do it properly.

 

My question is about using AD. The computers are all currently registered in AD (on the domain). What's the process that I need to do to reimage them, but have them joined to the domain and in an OU when they get imaged? Do I need to remove it from the domain before doing any imaging?

 

I'm using sysprep, and have got it to join the domain automatically, although it gives it a rubish name (eg domain-234k234). Not sure if I need Fog to do any AD stuff.

 

With blind sysprep and a ghost-type deployment, you can't have them join automatically with a name you specify, which is a bit of a pain. (With Windows Deployment Services you can, with a little substitution magic in your answer file.)

 

To be prompted during setup, set a blank name in the answer file and mini-setup will ask you at the appropriate point. The other steps you've automated will still take place as you specify.

 

To make sure they're in the right OU straight away, pre-stage the computer account in Active Directory (or if it already exists, just don't delete it) and make sure you use the same name during mini-setup.

[strawberry]

the appropriate point. The other steps you've automated will still take place as you specify.

 

To make sure they're in the right OU straight away, pre-stage the computer account in Active Directory (or if it already exists, just don't delete it) and make sure you use the same name during mini-setup.

 

Or you could include a vbs script on the desktop for first logon that moves the computer to the right ou based on computer name , i'm scrambling around but i may be able to produce it if you need it?

[rocknrollstar]

Thanks everyone for providing clarity. I think I will:

-leave computers in AD, as they will have the same name after being imaged

-leave blank in sysprep the computer name, and supply it at run time during minisetup

 

Seems so simple when you know how

 

Thanks again

[FN-GM]

Thanks everyone for providing clarity. I think I will:

-leave computers in AD, as they will have the same name after being imaged

-leave blank in sysprep the computer name, and supply it at run time during minisetup

 

Seems so simple when you know how

 

Thanks again

 

spot on exactly

[Michael]

Thanks everyone for providing clarity. I think I will:

-leave computers in AD, as they will have the same name after being imaged

-leave blank in sysprep the computer name, and supply it at run time during minisetup

 

Seems so simple when you know how

 

- Personally I wouldn't do this. Delete all the existing computer objects of the machines you're going to re-image. Also give the re-imaged machines slightly different names too. Workstation01 compared to Workstation001.

- Either supply an answer file with computer names, or automate Sysprep and just manually enter the computer name (how I usually do things)

- Once the machines are joined to the domain, move the computer objects into the relevant OUs so they pick up any computer policies you've set

- Then remember to install any AV software you have

[rocknrollstar]

Ok, this is what I am doing now! ::

 

- prepare imaged computer to perfection...

- remove from domain

- configure sysprep to add to domain when sysprep'd

- configure sysprep to prompt for a computer name from me (in sysprep.inf, make line look like COMPUTERNAME= with nothing after the equals sign).

- Using Fog to manage imaging.

 

We'll get there, let's hope it works... Thanks everyone for your help. Will update.

[FN-GM]

Ok, this is what I am doing now! ::

 

- prepare imaged computer to perfection...

- remove from domain

- configure sysprep to add to domain when sysprep'd

- configure sysprep to prompt for a computer name from me (in sysprep.inf, make line look like COMPUTERNAME= with nothing after the equals sign).

- Using Fog to manage imaging.

 

We'll get there, let's hope it works... Thanks everyone for your help. Will update.

 

Myself i dont remove the machine before sysprep, it doesn't make a difference

[Michael]

@rocknrollstar - No need to demote the machine from the domain. Sysprep will do this when the machine SID is reset.

 

@FN-GM - It's happened to me quite a few times before that machines appear to join the domain successfully, then when the machine reboots it's ready and waiting at the logon screen (which is normal), however when attempting to logon it fails saying the domain is unavailable. It's hit and miss, so this why I delete accounts. A new computer object must then be created during the Sysprep process.

[rocknrollstar]

It's happened to me quite a few times before that machines appear to join the domain successfully, then when the machine reboots it's ready and waiting at the logon screen (which is normal), however when attempting to logon it fails saying the domain is unavailable. It's hit and miss, so this why I delete accounts. A new computer object must then be created during the Sysprep process.

 

This is what I found happening- my solution was to remove the computer from AD before imaging.

 

Thanks

[dtakias]

This is what I found happening- my solution was to remove the computer from AD before imaging.

 

Thanks

 

I always reset/remove the imaged machines from the AD, as I've run into conflicts in the past when comes to GPO's associated with them.

As said before a new computer object has to be created during sysprep. When comes to computer names inside sysprep.inf I enter the first part of the computer name, which consists of the OS and the room name/location and then a symbol. For example " XP203* " . When sysprep detects the symbol it will eventually stop and then I enter the remaining part which is the number of the computer.