When new computers are joined to Active Directory, they are often created in the default Computers container. That can be a problem because objects in this location do not receive the Group Policy Objects you may have designed for newly added systems. As a result, software deployment, security settings, local administrator assignments, or login messages may not apply until the computer is moved manually.
A better approach is to redirect new computer accounts to a dedicated Organizational Unit from the start. That way, new systems immediately inherit the policies you want to enforce during the initial setup phase.
Why the default Computers container is a limitation
The default Computers container is not a normal OU, which means you cannot link Group Policy Objects to it. If a newly joined machine stays there, it will not receive the GPOs that are supposed to guide its first configuration.
This can be especially annoying in environments where you want to display a login notification, install software automatically, or apply baseline security settings before the machine is moved into its final OU.
The solution
The easiest fix is to create a separate OU for new computers, such as NewComputers, and then redirect the default computer account location to that OU. From that point on, every newly joined computer object will be created there instead of in the default container.
This requires at least a Windows Server 2003 domain functional level. If that requirement is met, the redirection can be done with a single command on a domain controller.
Step-by-step setup
- Create a new OU, for example
NewComputers. - Protect the OU from accidental deletion.
- Open an elevated Command Prompt on a domain controller.
- Run the following command:
redircmp OU=NewComputers,DC=domain,dc=tldThis changes the default location for newly created computer accounts.
What happens after that
After the redirection is in place, every new computer that joins the domain will be placed directly into the NewComputers OU. You can then link one or more GPOs to that OU and use them for initial configuration, notifications, software deployment, or any other onboarding task.
This is a clean and practical way to make sure new machines are not left in the wrong location and that your policies apply immediately.
Testing the configuration
After running the command, test the behavior by joining a new computer to the domain. The new computer object should appear in the NewComputers OU instead of the default Computers container.
If the object appears in the correct OU, the redirection worked and your linked GPOs can now take effect as planned.
Conclusion
Redirecting new computer accounts to a dedicated OU is a simple but effective Active Directory improvement. It ensures that new systems receive the right Group Policy Objects from the beginning and avoids the common problem of computers being left in the default container.
For environments with onboarding GPOs, security baselines, or login messages, this is a very useful administrative technique.