Why do some computers join OD and have a dollar sign ($) appended to the name?

Question

This question has been asked before here a few times with nobody being able to really definitively answer it (see: 2027636, 5979187, and 11144245).  It has been a couple of years and versions of OS X server and I am running into this same issue.  I am working on building an image to deploy Mavericks to our office computers and have been working on a script to set the hostname and join it to OD.  As a result I've been joining and unjoining this computer to our local OD server in an attempt to get the script working.  In the course of my troubleshooting, I've noticed that a number of computers in our domain have a $ appended to the name.  In fact, when I join my computer "office-test" it shows up in both workgroup manager and directory utility as 'workgroup-test$'.  If I remove the dollar sign from the end of the name in workgroup manager, the light next to the network server name goes from green to red on the client (in System Preferences -> Users & Groups -> Login Options).  The reason this has been an issue for me is that the script attempts to populate some attributes and make the computer join groups on the server (so it can get the proper MCX settings), but since my script is using 'office-test' as the computer name and not 'office-test$', it is failing.  We do have other computers with the $ appended (mostly windows machines).  We also have hosts that don't have the $.  Does anyone know why this happens and how to prevent/correct/change it?
This is what I'm trying to do:
#set variables
odserver=SERVER
odbindacct=ACCOUNT
odbindpass=PASS
computername=office-test
computerGroup=officegroup
#set hostname
scutil --set ComputerName ${computername}
scutil --set LocalHostName ${computername}
scutil --set HostName ${computername}.DOMAIN.TLD
#join OD
dsconfigldap -v -N -f -a ${odserver} -n ${odserver} -c ${computername} -u ${odbindacct -p ${odbindpass} -e
#update attributes
dscl -u ${odbindacct} -P ${odbindpass} /LDAPv3/${odserver} -merge /Computers/${computername} RealName ${computername}
#get GUID
GUID="$(/usr/bin/dscl -u ${odaccount} -p ${odpass} /LDAPv3/${odserver} -read /Computers/${computername} GeneratedUID | awk '{ print $2 }')"
# Add to computergroup/list
dscl -u "${odbindacct}" -P "${odbindpass}" /LDAPv3/${odserver} -merge /ComputerGroups/${computerGroup} GroupMembership ${computername}
dscl -u "${odbindacct}" -P "${odbindpass}" /LDAPv3/${odserver} -merge /ComputerGroups/${computerGroup} GroupMembers "${GUID}"
dscl -u "${odbindacct}" -P "${odbindpass}" /LDAPv3/${odserver} -merge /ComputerGroups/${computerGroup} Member ${computerid}
dscl -u "${odbindacct}" -P "${odbindpass}" /LDAPv3/${odserver} -merge /ComputerLists/${computerGroup} Computers ${computername}
In Directory Utility, I do see the following attributes/values set
AppleMetaRecordName (cn=office-test$,cn=computers,dc=[HOST],dc=[DOMAIN],dc=[TLD])
AuthenticationAuthority array ((;ApplePasswordServer;[HEX DATA]) (;Kerberosv5;;office-test$@[HOST].[DOMAIN].[TLD];[HOST].[DOMAIN].[TLD];))
RealName: (office-test$)
RecordName (office-test$)
ENetAddress ([MAC ADDRESS])
GeneratedUID ([UID])
HardwareUUID ([UUID])

Answer 1

I have observed the same issue on some 10.8.5 servers with 10.8.5 clients
This behavior happens when authenticated bind have been enabled on server.
Once authenticated, binded computers receive a ComputerName change during boot which append the dollar sign as appears in workgroup manager on server
System logs on clients computers shows
UserEventAgent receiving the $ name from _workstation._tcp.local (Workgroup Manager https://developer.apple.com/library/mac/qa/qa1312/_index.html)
and mDNSResponder updating/enforcing Computer Name accordingly.
Moreover, a binded computer will typically have « System Preferences ->> Sharing ->> Computer Name » option geyed out
The workaround i found:
1) moved  macosxodpolicy back from « authenticated bind required » to « enabled » and remove the $ sign from the end of each Computer name in workgroup manager.
This allows to keep reliables computers names for mcx administration on workgroup manager but
on the other hand, as you pointed out, this will also block network users on client computers.
so on clients computers:
2) Unbinded to clean the authentication entry and performed a simple bind —> without authenticated binding ( -f option) and admin/privileged network user (-l -u options)