Grant permission to add/remove computer from domain

Hello,  I'd like to grant my Student Worker's domain account  the necessary permissions to add and remove computers from my domain. I'm pretty sure this can be accomplished through the Delegation Control wizard, but what object do I grant then what level of permission..

*Windows 2000/2003 Active Directory Domain*

Thanks in advance!
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Toni UranjekConsultant/TrainerCommented:

You have delegwiz.txt file with more options for Delegation of Control attached. Download, rename file to delegwiz.inf, replace delegwiz.inf file in %systemroot%\inf folder. Run wizard again and select appropriate tasks, for example:

"Join a computer to the domain"
"Create a computer account"



Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Use Delegation of Control.
Create an AD Security group and add this user to it.
For this Group grant Add/Delete child objects when selecting Computer objects.
Do this at the domain level.
When complete, open up the Security on the Domain in ADUC and change the permissions for this group to Full Control for computer objects only.

If the Group doesn't have Full Control of Computer Objects then they cannot rename, delete or move existing computer accounts.
By default all members of the Domain Users group can join and disjoin computers to the network. Up to either 5 or 10.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

ehaleyAuthor Commented:
Toniur - This looks great, but do you have a link to this file on a Microsoft site. you must understand that I cannot run an .INF file on my network without it coming from a trusted source. Please do not take offense. I still wish to receive this file because it appears to add a lot of important items to the delegate Control Wizard.

Netman66 - I think this did the trick. I performed the steps as indicated above and my student worker was allowed to change his own workstation to a workgroup and back to the domain successfully.

LVNeptune - Incorrect, the ability to add-remove computer on a Windows 2000/2003 Active Directory domain is restricted to Domain Administrators, and as we see above, individuals whose accounts are granted the proper privileges.

Thank You all for your input!
Toni UranjekConsultant/TrainerCommented:
None taken, I've thought it would be easier for you. ;)

Here is link to "Appendix O: Active Directory Delegation Wizard File" from Microsoft:
LVNeptune - Incorrect, the ability to add-remove computer on a Windows 2000/2003 Active Directory domain is restricted to Domain Administrators, and as we see above, individuals whose accounts are granted the proper privileges.

Are you talking about adding and removing the machine from ADUC? If so that may be true.


"Windows 2000 grants the "Add workstations to domain" privilege to the Authenticated Users group by default"

Direct from microsoft.
Toni UranjekConsultant/TrainerCommented:
LVNeptune, correct. :D Any user can add up to 10 computers to domain by default.
I am confused why I am being told I am incorrect...
Regardless of what the texts say, try adding a computer to a domain as a normal user.

To begin with, you'd need to be local Admin to get the workstation part started off, but in the end you'll get denied.

He wanted a helper to have this right permanently rather than limit him to 5 joins (even if it worked).

Toni UranjekConsultant/TrainerCommented:
Netman66, I have never have problems to add computer to domain with standard domain user account, of course process has to be initiated with member of local administrators group.
I believe default qouta is 10.

IMHO, LVNeptun suggestion can work but in this case does not help, because asker wants his helpers to join "unlimited" number of computers to domain.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.