Search code examples
windowsactive-directoryfile-permissionsnetwork-shares

Active Directory: Is it possible to make the Computer$ account part of a group (for instance part of the USERS group)

Essentially what the subject is saying. The problem I'm trying to solve is this:

We have a website running in IIS ver8.5 and it needs to access a network share with rigid-ish permissions schemes. Our website's app-pool employs ApplicationPoolIdentity and it thus employs the Computer$ account of the host machine when it attempts to access network file-shares.

The problem we are encountering is that said network shares allow access only to members of the admins + users group. The computer$ account is part of neither of the aforementioned groups, resulting in access-denied error messages when our website attempts to access any file-share paths. We were wondering whether we could make the Computer$ part-take in the users group somehow (we tried the UI but it didn't provide the option to select any Computer$ accounts).

There are other solutions to this problem but we are interested to know if the above solution has any chance of being implementable before giving plan B a shot.

Solution

  • In the UI where you set permissions, you need to tell it to look for Computer objects. Do that by clicking the 'Object Types' button:

    Select Users Dialog

    Then check 'Computers'.

    Object Types

    Click 'OK', then you can find and add computers on your domain.