We help IT Professionals succeed at work.

Grant permission to add/remove computer from domain

ehaley
ehaley asked
on
25,262 Views
Last Modified: 2011-10-19
Hello,  I'd like to grant my Student Worker's domain account  the necessary permissions to add and remove computers from my domain. I'm pretty sure this can be accomplished through the Delegation Control wizard, but what object do I grant then what level of permission..

*Windows 2000/2003 Active Directory Domain*

Thanks in advance!
-Mike-
Comment
Watch Question

Consultant/Trainer
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
CERTIFIED EXPERT
Top Expert 2005
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
By default all members of the Domain Users group can join and disjoin computers to the network. Up to either 5 or 10.

Author

Commented:
Toniur - This looks great, but do you have a link to this file on a Microsoft site. you must understand that I cannot run an .INF file on my network without it coming from a trusted source. Please do not take offense. I still wish to receive this file because it appears to add a lot of important items to the delegate Control Wizard.

Netman66 - I think this did the trick. I performed the steps as indicated above and my student worker was allowed to change his own workstation to a workgroup and back to the domain successfully.

LVNeptune - Incorrect, the ability to add-remove computer on a Windows 2000/2003 Active Directory domain is restricted to Domain Administrators, and as we see above, individuals whose accounts are granted the proper privileges.

Thank You all for your input!
Toni UranjekConsultant/Trainer

Commented:
None taken, I've thought it would be easier for you. ;)

Here is link to "Appendix O: Active Directory Delegation Wizard File" from Microsoft:
http://technet2.microsoft.com/windowsserver/en/library/1d05f294-bb1e-4a55-aec3-2ee80f0db2791033.mspx?mfr=true
LVNeptune - Incorrect, the ability to add-remove computer on a Windows 2000/2003 Active Directory domain is restricted to Domain Administrators, and as we see above, individuals whose accounts are granted the proper privileges.



Are you talking about adding and removing the machine from ADUC? If so that may be true.

However,

"Windows 2000 grants the "Add workstations to domain" privilege to the Authenticated Users group by default"

Direct from microsoft.
Toni UranjekConsultant/Trainer

Commented:
LVNeptune, correct. :D Any user can add up to 10 computers to domain by default.
I am confused why I am being told I am incorrect...
CERTIFIED EXPERT
Top Expert 2005

Commented:
Regardless of what the texts say, try adding a computer to a domain as a normal user.

To begin with, you'd need to be local Admin to get the workstation part started off, but in the end you'll get denied.

He wanted a helper to have this right permanently rather than limit him to 5 joins (even if it worked).

Toni UranjekConsultant/Trainer

Commented:
Netman66, I have never have problems to add computer to domain with standard domain user account, of course process has to be initiated with member of local administrators group.
I believe default qouta is 10.

IMHO, LVNeptun suggestion can work but in this case does not help, because asker wants his helpers to join "unlimited" number of computers to domain.

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.