By product design, Active Roles uses a proxy account to create all objects in Active Directory. Due to this, all computer accounts created by Active Roles will have the Active Roles proxy account as the computer creator. Attempts by administrators to then add or reuse pre-existing computer accounts to the domain will fail, as the administrator attempting the domain join is not the Active Roles proxy account.
To workaround this behavior, the following actions may be taken:
- Add the Active Roles override / proxy account to the Domain Admins group. Per the Microsoft KB, if the computer account was created by a member of the Domain Admins group, the restrictions on computer account reuse are lifted.
- Disable or uninstall the changes introduced by KB5020276