Solved

Active directory: Deny write to "Computers" container

Posted on 2006-11-26
5
448 Views
Last Modified: 2010-04-18
Hi,

I've configured delegations for all sites admins over each of their perspective OU's.
non of them is a Domain Admins members.

Any system admin knows that he need to create the computer account in his OU prior to joining the macine to the domain.
Still, anyone that just join a computer to the domain, the compter acount being written to the "computers" container.

I wanna block the ability to write anything in that container.

I removed all permissions from the container, the only one that has access right now are "Domain Admins, System, enterprise Admins"

Users still have the option to join the machine to the domain.

Do I have any other option for that?

Thanx.
0
Comment
Question by:EERetUser
  • 2
5 Comments
 
LVL 6

Accepted Solution

by:
NadeemV earned 250 total points
ID: 18014020
Hi There,

You need to remove a setting from the Domain Controllers Security Policy.

Navigate down into User Rights Assignment and locate the right for "Add workstations to the Domain".

You will see that authenticated Users have the right to add workstations.

This is by Design in Windows 2003 so that users of XP workstations can add their own machines to the domain. All users have the ability to add 10 workstations using their own credentials. ie: you do not need to be an administrator to add a workstation to the domain. Some look at this as a security weakness and like to disable it in the security policy.

Regards,

NadeemV
0
 

Author Comment

by:EERetUser
ID: 18014063
Thanx, I'll check this option,
0
 
LVL 51

Expert Comment

by:Netman66
ID: 18014148
The Computers container is not an OU and therefore is treated differently.

What you can do, is redirect the default container to an OU where you can block this *feature*.

http://technet2.microsoft.com/WindowsServer/en/library/1919bb9f-adc9-4b7b-82f0-9bcaead3b81e1033.mspx?mfr=true
0
 

Author Comment

by:EERetUser
ID: 18387580
NetMan, thanx, very interesting option, but I think NadeemV answer will be better for my case.

Thanx
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Join & Write a Comment

Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
Learn about cloud computing and its benefits for small business owners.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now