Link to home
Start Free TrialLog in
Avatar of ehaley
ehaleyFlag for United States of America

asked on

Grant permission to add/remove computer from domain

Hello,  I'd like to grant my Student Worker's domain account  the necessary permissions to add and remove computers from my domain. I'm pretty sure this can be accomplished through the Delegation Control wizard, but what object do I grant then what level of permission..

*Windows 2000/2003 Active Directory Domain*

Thanks in advance!
-Mike-
ASKER CERTIFIED SOLUTION
Avatar of Toni Uranjek
Toni Uranjek
Flag of Slovenia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Avatar of Netman66
Netman66
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of LVNeptune
LVNeptune

By default all members of the Domain Users group can join and disjoin computers to the network. Up to either 5 or 10.
Avatar of ehaley

ASKER

Toniur - This looks great, but do you have a link to this file on a Microsoft site. you must understand that I cannot run an .INF file on my network without it coming from a trusted source. Please do not take offense. I still wish to receive this file because it appears to add a lot of important items to the delegate Control Wizard.

Netman66 - I think this did the trick. I performed the steps as indicated above and my student worker was allowed to change his own workstation to a workgroup and back to the domain successfully.

LVNeptune - Incorrect, the ability to add-remove computer on a Windows 2000/2003 Active Directory domain is restricted to Domain Administrators, and as we see above, individuals whose accounts are granted the proper privileges.

Thank You all for your input!
None taken, I've thought it would be easier for you. ;)

Here is link to "Appendix O: Active Directory Delegation Wizard File" from Microsoft:
http://technet2.microsoft.com/windowsserver/en/library/1d05f294-bb1e-4a55-aec3-2ee80f0db2791033.mspx?mfr=true
LVNeptune - Incorrect, the ability to add-remove computer on a Windows 2000/2003 Active Directory domain is restricted to Domain Administrators, and as we see above, individuals whose accounts are granted the proper privileges.



Are you talking about adding and removing the machine from ADUC? If so that may be true.

However,

"Windows 2000 grants the "Add workstations to domain" privilege to the Authenticated Users group by default"

Direct from microsoft.
LVNeptune, correct. :D Any user can add up to 10 computers to domain by default.
I am confused why I am being told I am incorrect...
Regardless of what the texts say, try adding a computer to a domain as a normal user.

To begin with, you'd need to be local Admin to get the workstation part started off, but in the end you'll get denied.

He wanted a helper to have this right permanently rather than limit him to 5 joins (even if it worked).

Netman66, I have never have problems to add computer to domain with standard domain user account, of course process has to be initiated with member of local administrators group.
I believe default qouta is 10.

IMHO, LVNeptun suggestion can work but in this case does not help, because asker wants his helpers to join "unlimited" number of computers to domain.