Add a computer to the domain

  • Thread starter Thread starter Jaz
  • Start date Start date
J

Jaz

I just learned that one of our uses was allowed to add a computer to the
domain even though they are not an administrator. How can prevent this from
happening? I'm not sure what changed but I don't think they were able to do
this before.

Any ideas?

Thanks,
Jasper
 
By default all users have the ability to add up to 10 computers to the
domain.

I can't find the exact KB article but the one below covers this info
indirectly.
http://support.microsoft.com/kb/251335/en-us

--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Do you know of any specific way of denying users from adding computers to
the domain?

I tried to deny access to "create computer objects" and "delete computer
objects" but that did not work.

Any ideas?
Thanks,
Jasper
 
Perhaps this one?

computer config - windows settings - Local policies - User rights
assignement - Add workstations to the domain

Regards
Per-Torben Sørensen
 
You can modify the settings via adsiedit, but Per-Torben's method should
work at the domain level. Just be careful how you apply the gpo so as not
to impact users who should be able to add machines.

--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
 
I'm sorry,

Where exactly is this? Am I creating a new Organizational Group and setting
this policy or does this already exist elsewhere?

Thanks,
Jasper
 
Its a Group Policy setting. Check into Group Policy and GPO's. They can be
applied to the domain or OU's. In ADUC right click the domain or OU, select
Properties, select the Group Policy tab, select the policy, and click Edit.
Per-Torben gave the path to navigate to find the setting, except I find it
is:

Computer Configuration, Windows Settings, Security Settings, Local Policies,
User Rights Assignment, Add workstations to doamin

It would apply to all computers in the domain or OU. Joe Richards'
suggestion would apply to the domain. You could use ADSI Edit to modify. The
default value is 10.
 
That will reset for all?

--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top