Active Directory delegated permissions computer objects

A user has been delegated rights to create computer accounts in the default computers container.

If the computer stays in the default computers OU for its life time,
What additional rights would they need to re-add the computer to the domain in situations where the computer drops off the domain?  this is effectively updating its password?

I am assuming modify object will cater for this?
cmatchettAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
cmatchettConnect With a Mentor Author Commented:
Is this correct?

http://support.microsoft.com/kb/932455

Reset Password
Read and write Account Restrictions
Validated write to DNS host name
Validated write to service principal name
0
 
Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
Best practice is to create Computers in other OUs and not the default Computers OU.  Also remember that non Domain Admins can only create 10 accounts.  If you delegate rights to a different OU, the user can create computers in that OU and you could delegate rights to manage computers.
0
 
cmatchettAuthor Commented:
ok, these group of people are only allowed to create computers in the default computers container.

what rights above create does a user need to re-add the computer to the domain, should fall off the domain.
0
 
Mohammed KhawajaConnect With a Mentor Manager - Infrastructure:  Information TechnologyCommented:
The security in the KB article is correct.  Reason for me suggesting different OU is due to the fact that you cannot apply GPOs to Users and Computers OU as they are special OUs.  If you are going to be adding computers and wish to apply GPOs to them then move them from the built-in OUs.
0
 
cmatchettAuthor Commented:
the kb article details the correct permissions
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.