Indiana University
  •  
  •  
  •  

Configuring your Windows Vista, XP Professional, or 2000 computer to connect to IU's ADS domain

Note: The directions below allow you to connect to the Active Directory Services (ADS) domain at Indiana University by creating a new user profile on your workstation. When you log into ADS using this new profile, none of the settings from your previous user profile will apply (e.g., Task Manager icons, desktop files, Outlook configuration). To restore these settings, you must copy your old user profile over to the new one; see In Windows, what is a user profile, and how do I copy one user profile to another?

To connect your Windows Vista, XP Professional, or 2000 Professional computer to the ADS domain:

Note: The instructions below work for Windows Vista Business, Ultimate, and Enterprise editions.

Resetting the local administrator password

To reset the local administrator password:

  1. From the Start menu, right-click Computer (Vista) or My Computer (XP and earlier), and then select Manage.

  2. Double-click Local Users and Groups, and then click Users.

  3. Right-click Administrator and choose Set Password.

  4. Enter the new password and confirm it.

Join your computer to the ADS domain

  1. In Vista, from the Start menu, right-click Computer; in XP or 2000, right-click the My Computer icon. Then, from the menu that appears, select Properties.

  2. In Vista, select Advanced System Settings. In the System Properties window, select the Computer Name tab and click Change.

    In XP, in the Systems Properties window, select the Computer Name tab and click Change.

    In Windows 2000, in the Systems Properties window, select the Network Identification tab and click Properties.

  3. Under "Member of", the selected radio button will show whether your computer is a member of a domain or a workgroup. If your computer is a member of a domain, follow the instructions in this step. If your computer is a member of a workgroup, skip to step 8.

    1. In the Computer Name Changes window (Windows Vista and XP) or Identification Changes window (Windows 2000), under "Member of", select Workgroup.
    2. In the "Workgroup:" field, type a temporary name and click OK.
    3. A Network Identification dialog box will appear. Click OK.
    4. You will then see another dialog box reminding you to reboot your computer. Click OK. The computer will restart.

  4. Navigate back to the Computer Name Changes (Vista or XP) or Identification Changes (2000) dialog box. Then, in the "Computer name:" field, type a new computer name that complies with the ADS domain naming convention. The naming convention requires names with the following components:

    1. A two-character campus code followed by a dash:

      • BL for Bloomington
      • EA for East
      • FW for Fort Wayne
      • IN for Indianapolis
      • KO for Kokomo
      • NW for Northwest
      • SB for South Bend
      • SE for Southeast

    2. A four-character department code followed by a dash
    3. A unique computer name up to seven characters in length

      Note: Do not insert any spaces in the computer name.

    For example, a University Information Technology Services (UITS) departmental computer at the Bloomington campus named "NAME" would be renamed "BL-UITS-NAME".

  5. Reboot your computer.

  6. After the computer restarts, log in again. You will most likely have to log in as Administrator, or as a user with administrative rights. Right-click the My Computer icon and, from the menu that appears, select Properties.

  7. In the Systems Properties window, in Windows Vista and XP, select the Computer Name tab and click Change. In Windows 2000, select the Network Identification tab and click Properties.

  8. In the Identification Changes window, under "Member of", select Domain. In the "Domain:" field, type ads.iu.edu.

  9. Click More....

    • In the "Primary DNS suffix of this computer:" field, enter ads.iu.edu.
    • Check Change primary DNS suffix when domain membership changes.
    • Click OK.

  10. You will then be prompted with the Domain Username And Password window for authentication. In the "Name:" field, type your username preceded by ADS\. In the "Password:" field, type your password. Click OK.

  11. A Network Identification dialog box will appear. Click OK. You will see another dialog box reminding you to reboot your computer. Click OK.

  12. Click OK to close the Identification Changes window. You may see a warning icon in the bottom portion of the Systems Properties window reminding you to reboot the computer. Click OK.

  13. You will see a System Settings Change dialog box. Click Yes to automatically reboot your computer.

Note: When you log into your computer after it reboots, in the "Domain:" field of the login prompt, select ADS to log into the Active Directory domain.

By default, ADS accounts will have user-level rights. For more, see At IU, in Windows 2000, XP, or Vista, how do I give myself or other users login privileges on my computer?

Further information

UITS recommends that all computers directly on the IU network (i.e., physically present and on the IU network, not wireless or off campus) should be joined to the Active Directory if possible, whether or not it is a department requirement.

In general, the following guidelines apply:

  • If you want or need to take advantage of once-per-session domain authentication (i.e., if you use Outlook to access your Exchange account, or if you regularly map drives or print to networked printers), the computer should be on the ADS domain. If it is not, you will have to enter a password for each service or resource you access.

  • If the local support provider (LSP) or local departmental administrator controls computer and network security through Group Policy Objects, the computer must be on the ADS domain.

  • If many different IU users use the computer, it should be on the ADS domain. Otherwise, you will have to create a local account for each individual user, or one "general" local account accessible by everyone. This option is not secure, as it allows all users to access all other users' files.

However, in some instances, you may not want your computer on the ADS domain.

If you use a portable computer or otherwise access the network wirelessly, joining the ADS domain will not give you the benefits listed above.

An Active Directory-joined computer will normally need to communicate with the network to log you in (two exceptions are mentioned below). At IU, that means a wireless computer needs a VPN connection first. Windows is able to log into a domain through a VPN connection, and in fact has no problem doing it, but relying on such a connection when logging in adds complexity as well as a potential point for problems to arise. Although Windows can easily work in this situation, and there are safeguards against problems (cached credentials will let you log in without a connection; so will logging into a local rather than an ADS account), you can avoid possible problems by not joining the Active Directory in the first place. You will have to weigh the potential for problems against the loss of benefits when deciding whether to add a computer to the Active Directory.