Restrict Employees from Joining the Domain

Hello,

I am running Active Directory and currently anyone can join a computer to our domain as long as you have valid domain credentials.
How do I restrict that so only an approved set of users can join a PC to the domain?  

Thank you!
zito2000Asked:
Who is Participating?
 
timgreen7077Exchange EngineerCommented:
0
 
Tom CieslikIT EngineerCommented:
You cans set a limit of workstation that single user can add to domain.

https://support.microsoft.com/en-us/help/243327/default-limit-to-number-of-workstations-a-user-can-join-to-the-domain


If you'll set limit to 0 then you'll lock domain and prevent users to join computers to domain.
0
 
JohnBusiness Consultant (Owner)Commented:
I am running Active Directory and currently anyone can join a computer to our domain as long as you have valid domain credentials.

In addition to the above, stop this practice, change the domain admin password to a strong and secure password. No one but domain admins should have this password.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
Sekar ChinnakannuStaff EngineerCommented:
Same can be done via delegation and enable same to specific set of users using AD groups https://prajwaldesai.com/allow-domain-user-to-add-computer-to-domain/
0
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
In addition to the above, stop this practice, change the domain admin password to a strong and secure password. No one but domain admins should have this password.
You are misunderstanding. Any normal user can join a device (limited to 10) as per ms-DS-MachineAccountQuota linked in above article

Delegation to allow a specific group can only be done after setting the value. If you do delegation, follow this principle
https://www.experts-exchange.com/articles/29366/Delegation-the-proper-way.html
0
 
JohnBusiness Consultant (Owner)Commented:
I have not ever seen a normal user join a domain. It will always request Domain Credentials. That is my experience in any event.
1
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
Try it
0
 
JohnBusiness Consultant (Owner)Commented:
I have. No possible on any of our Server Systems.  As I noted, my experience here.
0
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
AddWorkstationsToDomain-1-.png
0
 
JohnBusiness Consultant (Owner)Commented:
According to this (below) standard users can be granted the right. New to me and I did not know about that before.

But we do not grant anyone the right to join a domain.

https://blogs.technet.microsoft.com/dubaisec/2016/02/01/who-can-add-workstation-to-the-domain/
0
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
It is default
0
 
JohnBusiness Consultant (Owner)Commented:
It was removed in our setups here.
0
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
So? OP is not running your setup. It is the default behaviour
0
 
JohnBusiness Consultant (Owner)Commented:
Whenever we add a computer, we MUST use Domain Admin credentials to add it.
0
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
Whenever we add a computer, we MUST use Domain Admin credentials to add it.

That is just silly because you are exposing you DA account on a tier 2 device. You should never login to a workstation with DA
https://www.experts-exchange.com/articles/29515/Active-Directory-Simple-Tier-Isolation.html

You are leaving you DA hashes all over your environment. Easy to get and crack hashes similar to this
https://www.experts-exchange.com/articles/29569/How-to-extract-hashes-from-IFM-backup.html

Delegate on join to technicians like this
https://www.experts-exchange.com/articles/29366/Delegation-the-proper-way.html
0
 
JohnBusiness Consultant (Owner)Commented:
What is silly about adding a workstation to a domain?   That is necessary, not silly, and we do not let users do this.
0
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
Read my comment properly. You are using your DA account to join a domain. You are using your DA credentials on the workstation
0
 
zito2000Author Commented:
All of these options would work and are very helpful.
Thank you!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.