Can a computer be added to an AD group during creation with PowerShell?

The important question is what the GUI is actually allowed to do. If the same account can add the computer through the creation dialog, the delegated permission may be tied to the computer-creation workflow or to a particular OU, rather than being general permission to write the group’s member attribute. PowerShell cannot generally fake that workflow by creating the object halfway and then modifying the group.

If the failure is intermittent rather than consistently access denied, use the same -Server value for both commands and verify the object exists on that domain controller before adding it. If it is consistently permission denied, the proper fix is delegated rights or a service account designed for this task.

Use -PassThru and pass the resulting computer object explicitly. Also specify the same domain controller for every operation so you do not run into replication or object lookup differences:

$dc = 'DC01.example.com'
$ou = 'OU=Computers,DC=example,DC=com'
$computer = New-ADComputer -Name $ComputerName -Path $ou -Server $dc -PassThru
Add-ADGroupMember -Identity $GroupName -Members $computer -Server $dc

This is cleaner than piping into a command that also has an explicit -Members value. However, it will only fix object resolution or replication issues; it cannot bypass missing rights on the group.

The Active Directory GUI can create the computer and assign its group memberships as part of the same creation operation, but PowerShell exposes those as separate commands. New-ADComputer must create the object before Add-ADGroupMember can target it, and the second operation still requires permission to modify the group. Piping the commands together does not change that permission check.

A useful alternative is to create a disabled template computer with the desired properties and memberships, then use New-ADComputer -Instance to create new accounts from that template. Make sure the template object includes the properties you want copied, including its group-membership information where applicable. This is a workaround worth testing, but it does not magically grant permission if the directory refuses the resulting membership change.

The GUI and PowerShell are not necessarily making identical directory calls. New-ADComputer and Add-ADGroupMember are separate operations, so creating the account first is expected. A delay or forced replication may help when the error is caused by different domain controllers seeing different object state, but waiting will not resolve an authorization error.

Also verify that -Path contains the OU distinguished name itself, such as OU=Computers,DC=example,DC=com, rather than accidentally incorporating the computer name into the path.