Mini per to join computers to domain

Hello Expert,
I have a temporary person technician that comes in once in a while to do work for us.I want to assign him with the permission to join computers into our domain and remove the computers from our domain, no other access rights.
I use windows 2008 Domain Controller.

This is what I've done so far...
1 - created a user account for the technician.
2 - On the top domain name in Active Directory i right click and selected Delegation control wizard and Added that user into the delegate control.
3 - From the Delegate common tasks i selected only "Join a computer to the domain"
4- finish

I have tested the above configuration and came to understand that the user is not able to join computers into the domain,This is where I'm stuck... I want to know what else permissions i needed to assign to this user so that he can only join computers into our domain and Absolutely no other permissions

Waiting for your support.
Thank you.
smpvmAsked:
Who is Participating?
 
VB ITSConnect With a Mentor Specialist ConsultantCommented:
There's a few extra permissions you need to enable. You also need to use the delegate control wizard on the Computers container as this is where the computer object gets created when a machine joins the domain.

- In Active Directory Users and Computers, right click on the Computers container and then click Delegate Control..
- Click Add to add the account you created for your technician
- Select Create a custom task to delegate in the next window
- Select Only the following objects in the folder then tick the Computer objects box in the list
- Tick both the Create selected objects in this folder and Delete selected objects in this folder boxes
 
- In the next window tick these options under Show these permissions:
- General
- Property-specific
- In the Permissions box tick these options:
- Reset Password
- Read and write account restrictions
- Validated write to DNS host name
- Validated write to service principal name
Delegate-Control---Permissions-1.pngDelegate-Control---Permissions-2.png- Click Next then Finish when done
- Now try joining a computer to the domain
0
 
smpvmAuthor Commented:
Hello VB ITS,

You are the real Expert, perfect. It is working fine. Everyone happy with my solution infact the credit goes to you :)

Regards
0
 
smpvmAuthor Commented:
Best solution
0
 
VB ITSSpecialist ConsultantCommented:
Thanks smpvm! Happy to help :)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.