Solved

AD role to grant and remove computer

Posted on 2014-09-09
5
157 Views
Last Modified: 2014-09-14
What AD role should we add to a user in order to grant or remove a computer in AD. Tks
0
Comment
Question by:AXISHK
  • 2
  • 2
5 Comments
 
LVL 28

Accepted Solution

by:
becraig earned 250 total points
Comment Utility
Here are the steps to delegate that specific permission:
    Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
    In Active Directory Users and Computers, click View, and then click to select Advanced Features.
    Right-click Computers, and then click Properties.
    Click the Security tab, and then click Advanced.
    In the Access Control Settings for Computers dialog box, click Add, click the name of the user or group to whom you want to grant permission to remove computers from the Computers container, and then click OK.
    In the Permission Entry for Computers dialog box, click This object only in the Apply onto list.
    In the Permissions list, find the Delete Computer Objects permission, click to select the Allow check box next to this permission, and then click OK.
    In the Access Control Settings for Computers dialog box, click Add, click the name of the user or group to whom you want to grant permission to remove computers from the Computers container, and then click OK.
    Click the Properties tab, and then click computer objects in the Apply onto list.
    In the Permissions list, find the Write All Properties permission, click to select the Allow check box next to this permission, and then click OK three times.

More details from MS:
http://support.microsoft.com/kb/818091
0
 
LVL 4

Assisted Solution

by:Neeraj Kumar
Neeraj Kumar earned 250 total points
Comment Utility
You need to delegate rights to user to add or remove computer in AD.

Refer the below mentioned article

http://dizzyit.com/2013/05/23/delegate-authority-ad-add-remove-computers/
0
 

Author Comment

by:AXISHK
Comment Utility
can we simply grant users to accout or backup operators to get this right ? Tks
0
 
LVL 28

Expert Comment

by:becraig
Comment Utility
Domain users should by default have this permission, however the problem will be the permissions at the OU level.

That is why delegation is the best way to approach this:
e.g. your have an OU for computers for the accounting department in an "ACCOUNTS" OU you would not want to have regular domain users add / remove as such this is generally explicitly denied in secure environments.

If you want to give this ability to a group of users, I would suggest creating a new security group and adding the members you want to give this permission to the group, then delegating the right over that specific OU to that group.
0
 

Author Closing Comment

by:AXISHK
Comment Utility
Tks
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

We recently had an issue where out of nowhere, end users started indicating that their logins to our terminal server were just showing a "blank screen." After checking the usual suspects -- profiles, shell=explorer.exe in the registry, userinit.exe,…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now