Windows Forum

Ask something
Discussion Locked

Users able to add Computer to the Domain

0 helpful
8 replies

by philando 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have two users who are able to change their computer name and add them to the domain. They cannot add other computers to the domain, just their individual machine. I know in Win2k when you create a computer account in AD you have the option of chosing who can add that computer to the domain (Domain admin group by default). After a computer is added to the domain, how can you find out who is allowed to add that computer to the domain? The users are not members of any admin group or members of any group with sufficient rights to add computers to the domain. I think the problem has to do with the question I asked above. Any suggestions would be greatly appreciated.

8 replies

by voldar

To add a computer in a domain (join the computer to the domain) is an action permited only to administrators. You can delegate some rights to other users to have permission to add computers to the domain and many other stuff, but knowing which of the users have specific rights in an AD site, if u did not create a specific OU containing them before, it's hard to find.

by klausuhr

The only way to find out which users are permitted to add a specific computer to the domain is - as far as I know - to consult the associated ACLs on the computer's account in AD. In the MMC 'Active Directory Users and Computers' you have to locate the machine account. Right click the entry and choose the security tab. Here click the 'Advanced...' button. In the 'Permission Entries' look for entries where the following four permissions are attributed to an account or group: 'Write account restrictions', Validate write to service principal name', Validate write to DNS host name', 'Reset password'. When during the creation of a computer account you decided to delegate the right of 'join to domain' to another account or group (replacing the default Domain Admins), these are exactly the permissions which were attributed to the delegation account or group.

Checkpoint

by magetower

In an Active Directory setting all authenticated users can add up to 10 workstations to the domain. (why MS did this is beyond me)

There is a TechNet article that describes this 'feature'.

http://support.microsoft.com/default.aspx?scid=kb;en-us;251335

I have not actually tried changing the AD setting as suggested in the article to less then 10 for fear of mucking up the AD. (just need to stand up a test server :) )

later

This discussion is closed to new replies.