Prevent all from disjoin domain PC from domain except Domain admins

Hello Experts,

How can I deny any one from dis joining or leave domain and back to work group by GPO or any other way, I noticed that any local admin user can disjoin his PC or workstation from domain and when he asked for a username/password he cann press ok or cancle and the PC disjoind without problem and back to workgroup
ahmed_bqAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

oBdACommented:
You can't, unless you don't make them local admins.
A local Administrator by definition can do with the machine as he pleases, including removing it from a domain.
This is a company policy question, nothing about an OS configuration; users who can't be trusted to not remove their machine from the domain shouldn't be local admins to start with.
0
merowingerCommented:
The only option i see is to not have users with local admin rights
0
vmwarun - ArunCommented:
Under Computer Configuration -> Windows Settings -> Security Settings -> User Rights Assignment, there is a policy that states "Add Workstations to domain" using which you can define who has got the rights to add the Workstation to the domain.
Also remove "Create Computer Objects permission on the Active Directory computers" container.
0
The Five Tenets of the Most Secure Backup

Data loss can hit a business in any number of ways. In reality, companies should expect to lose data at some point. The challenge is having a plan to recover from such an event.

ahmed_bqAuthor Commented:
ok, what about powerusers ?
0
oBdACommented:
arunraju,
these are permissions to add a machine to a domain; the ability to disjoin the machine itself from the domain has nothing to do with this. You don't even need access to the domain if you want to disjoin it (luckily enough, otherwise a machine that was joined to a domain at some point could never be unjoined again if the domain goes offline before the machine was removed ...).
0
oBdACommented:
Power Users can't disjoin a machine.
0
vmwarun - ArunCommented:
oBdA : Thank you for the clear and concise explanation. I was under the impression that while disjoining a Computer from a domain, a check with the DC is done.
0
oBdACommented:
If the domain can be reached, and administrative permissions for the AD computer object are given, then the AD computer object will be disabled in AD while the machine is being removed. But these are independent operations, and a user can remove a machine from the domain at any time (whether the domain can be reached or not) if he has local admin permissions.
0
ahmed_bqAuthor Commented:
Hi guys,

I got a cool solution myself :)

I create a batch file that only allow full control access to a file called "netid.dll" in the path c:\windows\system32\netid.dll.

This batch hide the computerName Tab in system properties ... So they can not leave domain or change the computer name :)

To Hide:
cscript.exe /h:cscript
xcacls.vbs  %SystemRoot%\system32\netid.dll /P "MyDomain\domain admins":F /p system:F
cscript.exe /h:wscript

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
merowingerCommented:
lol nice workaround :)
0
ahmed_bqAuthor Commented:
Done
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Project Management

From novice to tech pro — start learning today.