I need the ability to have Help Desk create computer accounts in AD and then some other group of staff actually join the computers to the domain using the names that the Help Desk provided to them.
Problem is this:
If Tech-A attempts to join a computer to the domain using a computer name of a computer account that Tech-B created in AD, Tec-A is getting Access denied. I'm guessing because only Domain Admins and the Creator/Owner of the Computer Account can add it to the Domain.
I want Help Desk to be the only ones creating computer accounts in the Domain and then I want to be able to allow others to join those computers to the domain WITHOUT having to be members of the Domain Admins group.
I've tried everything I know and any help would be greatly appreciated.