Domain User Add Computers To Domain?

Windows 2003 Domain Controller, all computers in domain are Windows XP.

We have two new people in our group that we would like to be able to add computers to our domain.  They are regular "Domain Users", and we would like to keep them as such.  They will be adding computers via Control Panel >> System on the computer that is to be added.  How may we accomplish this?

I saw some threads regarding this, but it quickly got confusing.  I see that there is a policy on the DC at Domain Security Settings >> Security Settings >> User Rights Assignment that says "Add workstations to domain".

Will setting this policy (it is currently "not defined"):

a) OVERRIDE the default settings (as in, will I need to add Domain/Enterprise Admins to this policy as well?  or just those ADDITIONAL users I want to be adding computers?)

b)  Accomplish what I stated above.

Thank you.
dpsitAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AnthonyP9618Commented:
Hello dpsit,

From a Newsgroup posting... http://groups.google.com/group/microsoft.public.windows.server.security/browse_thread/thread/efdfa32218673cd6/6a3a3329faf3c83e%236a3a3329faf3c83e

Create new group called e.g. "Add Workstation to Domain" and all the
accounts from your helpdesk to this group. Now edit "Default Domain
Controller" group policy under "Computer Configuration\Windows
Settings\Security Settings\Local Policies\User Rights Assignment\". Here
look for policy named "Add workstations to domain" and double click on it.

Now add the group that you created (e.g. named "Add Workstation to Domain")
to this policy.

Wait for the replication to finish between the DCs and your help desk
personnel is now able to add workstations to domain.

Here is some more information on the policy.

Add workstations to domain
http://technet2.microsoft.com/WindowsServer/en/library/7207aa3e-d95d-4176-a1ca-bc629f1ca6981033.mspx?mfr=true
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jay_Jay70Commented:
by default a domain user can do what you are asking, you do not need to configure that policy
0
Jay_Jay70Commented:
too quick for me....
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

AnthonyP9618Commented:
:)

BTW... It's good to be back Jay!
0
Jay_Jay70Commented:
Goood mate :)
0
IvanVillamizarCommented:
10 times, only. If the users need to add more than 10 workstations, then you need eiither the policy or perrmissions to create computer objects in the OU where you want them to join computers.
If they are going to add less than 10 workstations to the domain, then as stated above, nothing needs to be done.
0
jmhquestCommented:
You may want to use a combination of setting the "add workstations to domain" user right on the default domain controllers policy (Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment) and granting the "Create Computer Objects" permission on the AD Computers container.

This MSDN page may be helpful: http://msdn2.microsoft.com/en-us/library/ms813615.aspx

Cheers.
0
jmhquestCommented:
Another Microsoft KB article you may find useful:

Enhanced security joining or resetting machine account in Windows 2000 domain

http://support.microsoft.com/kb/238793
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.