Most of my scripts use dynamic queries of Active Directory to get “all servers” using something like this:
The problems with this are:
- Non-domain joined servers aren’t in this list (obviously).
- Even if they were in the list, you’re trying to use a domain accounts credentials (remotely) on a standalone server (which won’t work).
The broad strokes to get this to work correctly are:
- Add dummy computer objects into Active Directory
- Create appropriate DNS records in the domain for the standalone servers
- Create a local account on each standalone server that has the same name and password as your domain account (that you use to run your scripts)
- Add a new registry key on each standalone server
In this example, I have two standalone Hyper-V servers named SVRHYP1 and SVRHYP2.
Firstly, create the dummy computer objects in Active Directory, making sure the accounts remain enabled and do not get disabled by some other script (that might be implemented to cleanup stale AD objects).
Modify the operatingSystem attribute to include the word “server” (so that the query above finds it):
Create the DNS records:
I use a domain account named DOMAIN\scripting.service with password “1234” to run my scripts.
Log on to each standalone server and create local accounts (and make them members of the local Administrators group) using the exact same username and password.
In my case, that would be SVRHYP1\scripting.service and SVRHYP2\scripting.service – both with the password of “1234”, and passwords set to never expire:
Lastly, on each standalone server, create a new registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
The key should be named LocalAccountTokenFilterPolicy as a DWORD with a Value of 1:
The result now, is that the server shows up in my AD query for all servers, and I can query it for information:
