Solved

Active directory: Deny write to "Computers" container

Posted on 2006-11-26
5
449 Views
Last Modified: 2010-04-18
Hi,

I've configured delegations for all sites admins over each of their perspective OU's.
non of them is a Domain Admins members.

Any system admin knows that he need to create the computer account in his OU prior to joining the macine to the domain.
Still, anyone that just join a computer to the domain, the compter acount being written to the "computers" container.

I wanna block the ability to write anything in that container.

I removed all permissions from the container, the only one that has access right now are "Domain Admins, System, enterprise Admins"

Users still have the option to join the machine to the domain.

Do I have any other option for that?

Thanx.
0
Comment
Question by:EERetUser
  • 2
5 Comments
 
LVL 6

Accepted Solution

by:
NadeemV earned 250 total points
ID: 18014020
Hi There,

You need to remove a setting from the Domain Controllers Security Policy.

Navigate down into User Rights Assignment and locate the right for "Add workstations to the Domain".

You will see that authenticated Users have the right to add workstations.

This is by Design in Windows 2003 so that users of XP workstations can add their own machines to the domain. All users have the ability to add 10 workstations using their own credentials. ie: you do not need to be an administrator to add a workstation to the domain. Some look at this as a security weakness and like to disable it in the security policy.

Regards,

NadeemV
0
 

Author Comment

by:EERetUser
ID: 18014063
Thanx, I'll check this option,
0
 
LVL 51

Expert Comment

by:Netman66
ID: 18014148
The Computers container is not an OU and therefore is treated differently.

What you can do, is redirect the default container to an OU where you can block this *feature*.

http://technet2.microsoft.com/WindowsServer/en/library/1919bb9f-adc9-4b7b-82f0-9bcaead3b81e1033.mspx?mfr=true
0
 

Author Comment

by:EERetUser
ID: 18387580
NetMan, thanx, very interesting option, but I think NadeemV answer will be better for my case.

Thanx
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question