Active directory: Deny write to "Computers" container

Hi,

I've configured delegations for all sites admins over each of their perspective OU's.
non of them is a Domain Admins members.

Any system admin knows that he need to create the computer account in his OU prior to joining the macine to the domain.
Still, anyone that just join a computer to the domain, the compter acount being written to the "computers" container.

I wanna block the ability to write anything in that container.

I removed all permissions from the container, the only one that has access right now are "Domain Admins, System, enterprise Admins"

Users still have the option to join the machine to the domain.

Do I have any other option for that?

Thanx.
EERetUserAsked:
Who is Participating?
 
NadeemVConnect With a Mentor Commented:
Hi There,

You need to remove a setting from the Domain Controllers Security Policy.

Navigate down into User Rights Assignment and locate the right for "Add workstations to the Domain".

You will see that authenticated Users have the right to add workstations.

This is by Design in Windows 2003 so that users of XP workstations can add their own machines to the domain. All users have the ability to add 10 workstations using their own credentials. ie: you do not need to be an administrator to add a workstation to the domain. Some look at this as a security weakness and like to disable it in the security policy.

Regards,

NadeemV
0
 
EERetUserAuthor Commented:
Thanx, I'll check this option,
0
 
Netman66Commented:
The Computers container is not an OU and therefore is treated differently.

What you can do, is redirect the default container to an OU where you can block this *feature*.

http://technet2.microsoft.com/WindowsServer/en/library/1919bb9f-adc9-4b7b-82f0-9bcaead3b81e1033.mspx?mfr=true
0
 
EERetUserAuthor Commented:
NetMan, thanx, very interesting option, but I think NadeemV answer will be better for my case.

Thanx
0
All Courses

From novice to tech pro — start learning today.