When running vastool status you receive the error:
"WARNING: 402 Computer object has UPN of: <> (expected <host/computer.domainname@realm.com>)."
This is usually caused by the joining account not having permissions to set the UserPrinicpalName (UPN) on the Computer Account host/ object.
For more details regarding permissions, refer to Quest Solution 29036 - "What user permissions are required for a delegated join to a domain?"
https://support.quest.com/SolutionDetail.aspx?id=SOL29036&pr=Authentication%20Services&st=Published
The UPN is optional, but could be set using the setattrs command.
/opt/quest/bin/vastool -u host/ setattrs -s host/ userPrincipalName host/machinename.yourdomain.com@YOURDOMAIN.COM
To set the permissions on the joining account:
The joining account requires:
Object permissions:
Reset Password
Object Properties:
Write DNS Host Name Attributes
Write userAccountControl
Write servicePrincipalName
(Optional but recommended)
Write Operating System
Write Operating System Version
Write userPrincipalName
RESOLUTION 1:
1 - Run run Active Directory Users and Computers console (dsa.msc) as Domain Administrator.
2 - Click on the OU where the computer account will be added, right click and select Delegate Control.
3 - Add the user on the list and select next
4 - Select a custom task to delegate, select next
5 - Select Computer Objects from the list of objects and next.
6 - Select the above noted permissions and properties.
RESOLUTION 2:
1 - Use a different account with more AD permissions after the -u in the command
© 2025 One Identity LLC. ALL RIGHTS RESERVED. Términos de uso Privacidad Cookie Preference Center