Why add computers to Active directory domain?

Question

I have been playing around with windows server and Active directory for quite some time. One can simply add a new user in AD and then add the client to the domain. this will create a domain account for the user.

I wonder what is the need to add computers to the domain in the server manager? Why adding a user to the domain is not enough?

I have searched on this topic but all the references talk about how to but I am looking for why to?

Solution 1

You put computers in AD for the same reason you put people in AD: Management and security.

You add users to your domain to give them access to different resources, but also to control their access. The same thing goes for computers. Just as you dont allow just anyone to log into the domain, you do not allow any computer access either.

Look in group policy, you will see just as much management criteria for computer as people. You can learn a lot just looking at the controls you have.

Solution 2

You join computers to the domain for centralized management. It enables you to use other Microsoft services, such as Group Policy (with per computer settings) and WSUS. Also, if a computer is joined onto a domain, any domain user can login to it while connected to the network.

Group Policy is extremely useful, in itself, as you can tweak very nearly every setting on a Windows computer (or group of computers, or all your computers) through it.

Comments

[Shurmajee]

what if the computer and user both have different set of security policy associated with them? which of them gets priority

[Shurmajee]

if i am adding a user to a domain then some other user of the domain can also login to the domain through that computer, Without really adding that computer

[Keltari]

restrictions always take precedence.