Configure admin account to have permissions to join machines to domain, but nothing else. Possible?

Posted on 2006-05-23
Last Modified: 2010-04-18
We have sysprep'd  a VM image that automatically (via sysprep.inf) joins the new VM's to the domain using a cloned domain admin account

at the the moment it has full admin privileges.

Is it possible to configure this user account to ONLY be able to join machines to the domain, and NOTHING else?

(worth doing as the hash of the pass is in the sysprep.ini file, & NTLM rainbow tables are getting quite complete these days.)

Question by:Wibble_
    LVL 48

    Expert Comment

    Hi Wibble_,

    you can try using the delegation of control wizard in AD under the OU where the user account resides
    LVL 19

    Accepted Solution

    Create a normal user and delegate the add workstations to domain privilege to that user:

    Featured Post

    Highfive Gives IT Their Time Back

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
    I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    731 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now