Need help with delegating GPO rights

  • Thread starter Thread starter Michael Holzemer
  • Start date Start date
M

Michael Holzemer

BoostGeek said:
We have some technicians that are somewhat inadequate when it comes to
being computer savvy. But I need them to be able to add workstations
to the domain, logon on to servers (DCs and Member), shut down servers
and view the event log.

I understand the Add Workstations To Domain right works but it only
works up to 10 times. I know the Create computer objects right would
solve this but with wanting them to be able to login, I don't actually
want them to be able to go into the structure and add objects by
mistake in there, other than the computers they add to the domain.
Click to expand...

What have you seen that indicates that the add workstation to the domain
right works only 10 times? I am familiar with the fact that the default
logons without a domain controller is 10 times (max 50), but have yet to see
a limit on the add rights. Is this perhaps what you are referring to?

--
Regards,

Michael Holzemer
No email replies please - reply in newsgroup

Learn script faster by searching here
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/scriptcenter/default.asp
 
We have some technicians that are somewhat inadequate when it comes to
being computer savvy. But I need them to be able to add workstations
to the domain, logon on to servers (DCs and Member), shut down servers
and view the event log.
Click to expand...

Pretty much sounds like an "Account Operator" -- check it out and see
if that meets you needs.
 
We have some technicians that are somewhat inadequate when it comes to
being computer savvy. But I need them to be able to add workstations
to the domain, logon on to servers (DCs and Member), shut down servers
and view the event log.

I understand the Add Workstations To Domain right works but it only
works up to 10 times. I know the Create computer objects right would
solve this but with wanting them to be able to login, I don't actually
want them to be able to go into the structure and add objects by
mistake in there, other than the computers they add to the domain.

Any info would be great. Thanks.


BoostGeek
 
Account operator would allow also allow the techs to create user accounts &
groups, probably something that Boast does not want.
Boast,
Take an OU, right click, select Delegate control, and then give the techs
the ability to add computer objects to the domain. The techs can then add
computer accounts to the domain.
As far as logon onto the server, make the techs Server Operators to log and
shut down the server.
HTH,
BrianK
 
Back
Top