2008R2 Active Directory - Delegate rights to users to join machines to AD but not users
Posted on 2014-01-27
We have departmental technicians that need to be able to pre-stage and join machines in particular OUs but not be able to create users. At the moment we just make them members account operators, but this gives them access to create both users and machines, and in any OU. Maybe if we could create separate groups that are similar to the Account Operators, but can only create/join machines to designated OUs? Or by using delegated rights, but really not sure what boxes to tick on that one.