• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 513
  • Last Modified:

grant user permission to join his computer to the domain

hi experts,

 how can I grant a user permission to have his laptop join the domain himself and not grant him any admin rights?
1 Solution
AFAIK a normal Domain User can add max 10 PC's to domain
First, create a group for the psuedo-admins in the domain. In AD, delegate control to the OU's they may need to manage (create/delete accounts, or maybe just reset passwords, or nothing at all).
Then use Group Policy to add your group to the local administrators group on the workstations and servers using Computer\Windows Settings\Security Settings\Restricted Groups. Do not deploy this policy to the Domain Controllers OU or the OUs containing your servers
Will SzymkowskiSenior Solution ArchitectCommented:
Jburgaard is correct which is enabled by deafult. It is highly recommended that you either disable this or lower the value. You will need to modify the Default Domain policy setting which you can allow or deny a user or groups from adding machines to a domain.

Modify the following area in GPO
Computer Configuration | Windows settings | Security Settings | User Rights Assignment | Add Workstations to the Domain

Also another thing you can do it "pre-create" the computer object for this user and then have the user add the machine to the domain.

When "pre-createing" the computer object you can put it in a OU of your choice beforehand and so impose GPO-settings.
frankbustosAuthor Commented:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free tool for managing users' photos in Office 365

Easily upload multiple users’ photos to Office 365. Manage them with an intuitive GUI and use handy built-in cropping and resizing options. Link photos with users based on Azure AD attributes. Free tool!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now