Managing Computers with Active Roles

Not only do we have to create and maintain users, but we also have to have the computer accounts that go along with them. And this is something active roles handles, as well. One nice thing about active roles is I can have active roles actually do things for me. So I can create a computer. And you'll notice here that it's gone ahead and pre-populated everything for me. I've forced the person using active roles to give me a location. And you'll notice here that it's a drop down. And I've done this through an active roles policy. But if I click Los Angeles, and I click Finish, it will create that computer account. And if I drill down, what I've actually told it to do is I've created a workflow. And I've told it in that workflow, hey, whenever a computer account is created in these different locations, I want you to automatically move that to the correct OU. So what you'll see here is acme.lab is my domain. Workstations is in OU underneath that. AMER is in OU underneath that. And Los Angeles is the OU that I actually told it to put it in. I didn't create this account here. That's just where it was moved to automatically through active roles. But we can get even better than that. So let's say the person who owns test computer here ends up moving from Los Angeles to, let's say-- from, say, Los Angeles to, let's say, Tokyo. So I click over here on Tokyo, and I click Save. Once I do that, the workflow that I've created will actually go back now and move that. You'll notice here in the Los Angeles OU, it's not there anymore. But if I click back here on workstations, and APAC, and Tokyo, you'll see that workstation was there. Now the help desk person who made that change doesn't need to know anything about it. Just that that's what's done on the backend-- keeping Active Directory nice and clean. And also, if you're doing some of your templating and your policies through OUs or managed units or whatnot, we now will make sure that the correct group has rights over that account now that it's moved to where the user that it belongs to is.