users have too many permissions

  • Thread starter Thread starter Jo Ramo
  • Start date Start date
J

Jo Ramo

Hello

Every single user in my domain can add a computer to our
domain. The setting is NOT set in a GPO. Where can I
disable their permissions?

Thank you. Jo
 
Have you checked to see whether all users in that machine
(user's)maybe part of the local admin group?
 
Hello Jo Ramo

Note that by defaults every user have access to join 10 computers to an
Active Directory Domain, You Override the Default Limit of the Number of
Computers an Authenticated User Can Join to a Domain and increase or
decrease the value of the Active Directory ms-DS-MachineAccountQuota
attribute

a.. Use an Active Directory Services Interface (ADSI) script to increase or
decrease the value of the Active Directory ms-DS-MachineAccountQuota
attribute. To do this:
1.. Install the Windows 2000 Support tools if they have not already been
installed. To install these tools, run Setup.exe from the Support\Tools
folder on the Windows 2000 Server or the Windows 2000 Professional CD-ROM.
2.. Run Adsiedit.msc as an administrator of the domain.
3.. Expand the Domain NC node. This node contains an object that begins
with "DC=" and reflects the correct domain name. Right-click this object,
and then click Properties.
4.. In the Select which properties to view box, click Both.
5.. In the Select a property to view box, click ms-DS-MachineAccountQuota.
6.. In the Edit Attribute box, type a number. This number represents the
number of workstations that you want users to be able to maintain
concurrently.
7.. Click Set, and then click OK.

--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1
 
The default in a Win2K domain is that any authenticated user may add up to
10 computers to a domain. Check support article 251335 for more information.

Arild
 
Back
Top