Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Need a user to add computers to the domain without having domain admin rights

Posted on 2004-03-25
8
Medium Priority
?
184 Views
Last Modified: 2013-12-04
Greetings,

I have a user called wsadmin.  This user is my workstation administrator and has local admin rights on all workstations.  User can not log on locally to any server.  I need this user to be able to add systems to the domain since he builds them.  I tried Group Policy in the User Rights Assignment section and added him to Add workstations to domain.  Didn't work.  I also tried adding user to Account Operators group which didn't work.  Anyone know a good way to allow user to add systems to the domain withought being a member of domain admins?

P.S. I thought of runas but you have to supply password.  I do not want this user to have the password for a domain admin account.
0
Comment
Question by:netadmins
  • 3
  • 2
8 Comments
 
LVL 12

Expert Comment

by:trywaredk
ID: 10680881
Delegation of Administration Using Microsoft Management Console
http://support.microsoft.com/default.aspx?scid=kb;en-us;201341&Product=win2000

Many Regards
Jorgen Malmgren
IT-Supervisor
Denmark

:o) Your brain is like a parachute. It works best when it's open
0
 

Author Comment

by:netadmins
ID: 10681517
Thanks trywaredk,

I'm not sure if this applies though.  The user is logged on as local administrator at a workstation not yet joined to the domain.  The user attempts to add the system to the domain.  After typing in the domain the user is prompted with a logon.  When they try to logon the get this error:

Logon Failure: the user has not been granted the requested logon type at this computer.

The only way I have been able to allow the user to do this is add them to domain admins.  I only want the user to have local administor rights on the workstation and be able to add and remove computers to the domain.  Have not been able to figure out how to pick and choos what the user can do within the domain.
0
 
LVL 6

Accepted Solution

by:
DanniF earned 200 total points
ID: 10686382
This is actually taken from a document concerning joining an NT4 machine but this is what you do on the 2000 controller to solve your problem:

NOTE, I have edited this procedure to fit your environment, for the original document, see:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;251335

Method 2: Grant the "Create Computer Objects" and "Delete Computer Objects" Access Control Entries (ACEs) to the User
From the Active Directory Users and Computers snap-in, click Advanced Features on the View menu so that the Security tab is exposed when you click Properties.
Right-click the Computers container, and then click Properties.
On the Security tab, click Advanced.
On the Permissions tab, click The user name

Make sure the This object and all child objects option is displayed in the Apply onto box.
From the Permissions box, click to select the Allow check box next to the Create Computer Objects and Delete Computer Objects ACEs, and then click OK.

Hope this helps,

Daniel F.
0
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

 

Author Comment

by:netadmins
ID: 10930172
Been trying to figure out how to close questions so I can shut this one down.  Thanks for the help.
0
 
LVL 12

Expert Comment

by:trywaredk
ID: 10967214
The Experts Exchange Help Pages - About Closing Questions
http://www.experts-exchange.com/Security/Win_Security/help.jsp - hi9
0
 
LVL 12

Expert Comment

by:trywaredk
ID: 10967226
The Experts Exchange Help Pages - About Closing Questions
http://www.experts-exchange.com/Security/Win_Security/help.jsp#hi9

0

Featured Post

Ready for your healthcare security check-up?

In the past few years, healthcare organizations have become a prime target for advanced attacks. Does your organization have what it needs to defend itself? Schedule your healthcare security check-up today and download our free Healthcare Security Resource Kit today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…
Suggested Courses

886 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question