mancunia
asked on
Allow Administrator to add machines to domain
I have a collegue who works at a remote site, who needs to be able to add and remove systems from a win 2000 domain.
I need to prevent him from adding or altering user accounts..
How can I specify his roles and which group should he be a member of ?
Im fairly sure I used to be able to configure Administrator roles when running NT
Many thanks
I need to prevent him from adding or altering user accounts..
How can I specify his roles and which group should he be a member of ?
Im fairly sure I used to be able to configure Administrator roles when running NT
Many thanks
That's half the story. If you don't want him modifying user accounts, don't make him an administrator, but make a new OU and delegate him the ability to do what he needs through the "Delegation of Control" wizard on the OU itself.
aleinss is correct - but you can also do this with a specific user or security group as well. Here's the steps:
If you will have multiple people, Create a new group (i.e. "AllowAddComputersToDomain
From the Active Directory Users and Computers snap-in, click Advanced Features on the View menu so that the Security tab is exposed when you click Properties.
Right-click the Computers container, and then click Properties.
On the Security tab, click Advanced.
On the Permissions tab, click Add, and add the user or group you created above. Click OK then click Advanced, and then click View/Edit.
Make sure the This object and all child objects option is displayed in the Apply onto box.
From the Permissions box, click to select the Allow check box next to the Create Computer Objects and Delete Computer Objects ACEs, and then click OK.
See Microsoft KB Article http://support.microsoft.com/default.aspx?scid=kb;EN-US;251335 (their example shows adding the ability for Authenticated users...you'd simply be modifying this to include specific Users or groups)
If you will have multiple people, Create a new group (i.e. "AllowAddComputersToDomain
From the Active Directory Users and Computers snap-in, click Advanced Features on the View menu so that the Security tab is exposed when you click Properties.
Right-click the Computers container, and then click Properties.
On the Security tab, click Advanced.
On the Permissions tab, click Add, and add the user or group you created above. Click OK then click Advanced, and then click View/Edit.
Make sure the This object and all child objects option is displayed in the Apply onto box.
From the Permissions box, click to select the Allow check box next to the Create Computer Objects and Delete Computer Objects ACEs, and then click OK.
See Microsoft KB Article http://support.microsoft.com/default.aspx?scid=kb;EN-US;251335 (their example shows adding the ability for Authenticated users...you'd simply be modifying this to include specific Users or groups)
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
under administrative tools open the Domain Security policy (make sure its the domain security policy you open and not the local policy!)
you can assign rights to any user or group here to add PC's to the domain :)