How to Reuse a Computer-Name

When we provide a new user a computer that was used by a different person, the norm is to reset everything and deliver a clean device. But what if we want to reuse the generic pc-name that is already setup? Let's say HOWARD-998. Once we try to enter the network with the user's account, we are going to get an error saying that HOWARD-998 has already been taken and we have to remove it from Active Directory/Azure. We see this warning, not because the system crashed or due to a bug; not at all. The reason is that the computer attempts to register itself in our local network's Active Directory. Because a computer object named HOWARD-998 already exists inside our on-premises Active Directory Domain Controllers, the domain blocks the new machine from claiming that same name to prevent identity hijacking. So, the answer to the question is YES, we can reuse the name, BUT we have to take some extra careful steps when getting to the path that will allow us release that name from the previous user's account.

If the device is pre-built (e.g. Dell, HP, etc), all we have to do is to log in to Microsoft Entra Admin Center (that's the service we use here at Howard Industries), on the left side bar click on Devices (right below Groups), then click on All Devices, and type in the search bar the device name that we want to release. We have to select the device and click on DELETE. If there is more than one instance with the same name, select all of them for deletion.

Then, we have to proceed with the domain join or provisioning setup.

If the device is a custom computer built in our company, we have to take an extra step. Just going to our Entra account will not definitely remove and release the name. The difference between a pre-built computer and a custom-built machine comes down to an Active Directory security mechanism called Domain Join Hardening (specifically CVE-2022-38042). Microsoft introduced a security update that changes how computers join a domain when an account with the same name already exists.

For the out-of-the box computer: When a brand-new computer joins our domain, it uses its unique factory security identifiers, or our IT deployment process might pre-stage the object using specific administrative credentials. Because the original computer objects and the new installations are tightly coupled with automated deployment IDs, Active Directory allows the reuse of the name.

For the custom-built computer: Because this machine was built from parts in our office, its motherboard, network card, and hardware security chips (TPM) have completely different hardware signatures than whatever old machine originally occupied the HOWARD-998 slot in our network. Since the hardware signatures don't match, Active Directory's security hardening blocks the join process. It views the custom PC as an untrusted, completely separate device trying to "hijack" an existing computer identity (HOWARD-998) on our network.

Here's the extra step:

We have to log in to the server, where we can access Azure AD Connect (this system is currently installed in HIDC01 and it is the one acting as a bridge that connect our Microsoft Entra account with the local server environment).

Once on the server desktop, do the following:

1. Click the Windows Start Menu.

2. Type Active Directory Users and Computers and open it (or press Windows Key + R, type dsa.msc, and hit Enter).

3. Click on the Computers folder in the left-hand tree (or search your custom Organizational Units if your company categorizes workstations).

4. Locate the old HOWARD-998 record in the list.

5. Right-click it and choose Delete.

Speeding up the sync (Optional)

Azure AD Connect naturally syncs changes every 30 minutes. If you want to jump straight back to setting up the custom-built computer without waiting, you can force an immediate sync from that same server:

1. Open PowerShell as an Administrator on the server.

2. Run this command to force a delta synchronization cycle:  Start-ADSyncSyncCycle -PolicyType Delta

If the Computers folder is empty, we will have to try other folders, but most likely is that the devices names are nested under MyBusiness/Devices/Computers.

So, we delete the local object (right-click on HOWARD-998 right there in that folder and click on DELETE. We confirm the prompt to permanently remove it from our local domain. Then, we force the synchronization signaled in the previous step 2.

We disconnect from the server and go back to the new device to continue with the Domain Join wizard.   Because the old active machine account footprint has been completely removed from both our on-premises domain controller and our cloud sync, Active Directory will now allow the newly built machine to claim the HOWARD-998 identity as a clean slate.