Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Why all Domain Users can join their PC to the domain?

Posted on 2010-01-12
9
Medium Priority
?
610 Views
Last Modified: 2012-05-08
I just noticed that any user (Domain User) can join his/her PC to the domain and also change the machine name on the network.

We have a 2 domain controllers (Windows 2003 Standard Server)
0
Comment
Question by:kvelkhoury
  • 4
  • 3
  • 2
9 Comments
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 26295373
Windows 2003 based AD allows this behavior by default, with a 10 computer limit. You can limit this in group policy security settings, local settings, user rights assignment.
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 1400 total points
ID: 26295387
By default they can actually join 10 machines to the domain
http://support.microsoft.com/default.aspx/kb/243327/en-us
You can change it (outlined in the article)
Thanks
Mike
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 26295389
The setting is "Add workstations to Domain"
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 

Author Comment

by:kvelkhoury
ID: 26302061
Isn't there any other way other than what microsoft shows? Plus, how do I install the windows support tools on windows 2003? (In windows 2000 it was straight forward, but not sure on windows 2003?)
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 26303903
You can download the support tools here  http://www.microsoft.com/downloads/details.aspx?familyid=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en
They are also on the 2003 disck in the tools folder.
No other way other way that I know of
Thanks
Mike
0
 

Author Comment

by:kvelkhoury
ID: 26306963
Thanks mkline71, I will try it, but can someone give me a simpler explanation for not allowing domain users from joining computers to the domain?
0
 
LVL 47

Assisted Solution

by:Donald Stewart
Donald Stewart earned 600 total points
ID: 26307241
You can do the opposite mentioned in this article
 
http://www.infinitconsulting.com/News-Events/TechNotes/limit-workstations.html 
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 26307316
Easiest way would be to use the GPO setting in the Default Domain Controllers Policy:

Computer configuration, windows settings, security settings, Local Policies, User Rights Assignment "Add workstations to the domain"

Here remove the "Authenticated Users" and add only the security groups you like to have. At least domain administrators.
0
 

Author Comment

by:kvelkhoury
ID: 26335179
If I set the attribute "ms-DS-MachineAccountQuota" to zero, then does that mean the Domain Users will NOT be allowed to join PCs to the domain? Or does it mean that they can join unlimited joins?

In conclusion, what value do I set it up to?
0

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
Scripts are great for performing batch jobs against users, however sometimes the GUI is all you need.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

581 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question