Solved

I wish to allow a user rights to join computers to domains but not give access to all admin

Posted on 2016-09-05
2
35 Views
Last Modified: 2016-09-05
Hi all, i wonder if you could help, as per the title "I wish to allow a user rights to join computers to domains but not give access to all admin" We have a local domain and i would like to be able to allow a trusted user access to join new computers to this domain but don't really want to give them full admin rights or indeed access to admin areas etc.
Is this possible?
many thanks
0
Comment
Question by:Shifnal
2 Comments
 
LVL 16

Accepted Solution

by:
Dirk Mare earned 500 total points
ID: 41784532
You need to delegate the appropriate permissions to the specific user our group.

On your server..
1. Click Start, click Run, type dsa.msc, and then click OK.
2. In the task pane, expand the domain node.
3. Locate and right-click the OU that you want to modify, and then click Delegate Control.
4. In the Delegation of Control Wizard, click Next.
5. Click Add to add a specific user or a specific group to the Selected users and groups list, and then click Next.
6. In the Tasks to Delegate page, click Create a custom task to delegate, and then click Next.
7. Click Only the following objects in the folder, and then from the list, click to select the Computer objects check box. Then, select the check boxes below the list, Create selected objects in this folder and Delete selected objects in this folder.
8. Click Next.
9. In the Permissions list, click to select the following check boxes:
    Reset Password
    Read and write Account Restrictions
    Validated write to DNS host name
    Validated write to service principal name
10. Click Next, and then click Finish.
11. Close the "Active Directory Users and Computers" MMC snap-in

DirkMare
0
 

Author Closing Comment

by:Shifnal
ID: 41784538
Brilliant thanks for that
0

Featured Post

Why do Marketing keep bothering you?

Is your marketing department constantly asking for new email signature updates? Are they requesting a different design for every department? Do they need yet another banner added? Don’t let it get you down! There is an easy way to manage all of these requests...

Join & Write a Comment

If you migrate a Terminal Server licenses server inside the 2008 server family, you can takte advantage of the build-in migration tool. If you like to migrate an older 2003 Server (and the installed client CALs) to a 2008 R2 server for example, you …
You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now