We have recently migrated to Windows Server 2008 domain and it seems users (with standard domain rights) are able to join there PC to the network using there own user credentials.
How are we able to lock this down so that only Domain Admins can perform this task.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
If a user has local administrative rights of their own PC and a Domain user account, they can join their PC to the Domain. In this case, you'll want to remove their local administrative privileges to prevent them from joining systems to the domain.
Definitely not the most secure process...
Hope this helps...
Mike
Use adsiedit.msc to check the ms-DS-MachineAccountQuota attribute; this is the number of workstations a regular user is allowed to join to the domain. Since W2k, this has been set to 10 by default. It's best to set that to 0.
Default Limit to Number of Workstations a User Can Join to the Domain
http://support.microsoft.c
ADSI Edit (adsiedit.msc) Overview
http://technet.microsoft.c
MikeHolcomb,
domain users are only allowed to join machines to the domain if either
- they have been delegated this permission explicitly
- they haven't used up their quota as set in the ms-DS-MachineAccountQuota attribute
Setting the ms-DS-MachineAccountQuota to 0 will prevent any default user form joining a machine to the domain, whether he has a local admin account or not.
Business Accounts
Answer for Membership
by: Raheem05Posted on 2009-10-25 at 17:28:27ID: 25659131
Click Start, click Run, type dsa.msc, and then click OK
Under Security Settings/Local Policies/User Rights Assignment - Add workstations to domain edit permissions and set to domain admins only