[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 466
  • Last Modified:

Active directory: Deny write to "Computers" container

Hi,

I've configured delegations for all sites admins over each of their perspective OU's.
non of them is a Domain Admins members.

Any system admin knows that he need to create the computer account in his OU prior to joining the macine to the domain.
Still, anyone that just join a computer to the domain, the compter acount being written to the "computers" container.

I wanna block the ability to write anything in that container.

I removed all permissions from the container, the only one that has access right now are "Domain Admins, System, enterprise Admins"

Users still have the option to join the machine to the domain.

Do I have any other option for that?

Thanx.
0
EERetUser
Asked:
EERetUser
  • 2
1 Solution
 
NadeemVCommented:
Hi There,

You need to remove a setting from the Domain Controllers Security Policy.

Navigate down into User Rights Assignment and locate the right for "Add workstations to the Domain".

You will see that authenticated Users have the right to add workstations.

This is by Design in Windows 2003 so that users of XP workstations can add their own machines to the domain. All users have the ability to add 10 workstations using their own credentials. ie: you do not need to be an administrator to add a workstation to the domain. Some look at this as a security weakness and like to disable it in the security policy.

Regards,

NadeemV
0
 
EERetUserAuthor Commented:
Thanx, I'll check this option,
0
 
Netman66Commented:
The Computers container is not an OU and therefore is treated differently.

What you can do, is redirect the default container to an OU where you can block this *feature*.

http://technet2.microsoft.com/WindowsServer/en/library/1919bb9f-adc9-4b7b-82f0-9bcaead3b81e1033.mspx?mfr=true
0
 
EERetUserAuthor Commented:
NetMan, thanx, very interesting option, but I think NadeemV answer will be better for my case.

Thanx
0

Featured Post

Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now