I have two users who are able to change their computer name and add them to the domain. They cannot add other computers to the domain, just their individual machine. I know in Win2k when you create a computer account in AD you have the option of chosing who can add that computer to the domain (Domain admin group by default). After a computer is added to the domain, how can you find out who is allowed to add that computer to the domain? The users are not members of any admin group or members of any group with sufficient rights to add computers to the domain. I think the problem has to do with the question I asked above. Any suggestions would be greatly appreciated.
