Users being able to add 10 computers to a domain

[Ben-BSH]

As i learnt on my Latest course, normal users ( in our case students ) have the ability to add 10 computer accounts to a Domain. i am the apprentice and do not want to fiddle too much, in case of breaking something and then being hunted through the building before experiencing a horrible painful death.

 

SO. i come to ask if anyone knows a simple solution to this security hole? Thanks.

[SC-UK]

Although this is technically true, if your network is fairly secure anyway - there should be no option that they can access to join a domain anyway. They shouldn't be allowed to get into the rename computer dialogue or anything like that.

 

The only place this may be an issue is students bringing in laptops from home and joining them to the domain but there are a number of different solutions to this.

 

Tom

[Jamman960]

This can be configured via group policy, haven't got time to check right now but surely this isn't the default anyway?

 

Creating a Computer Account Management Plan: Logon and Authentication should shed more light on the issue.

 

James

[plexer]

Specifically this bit:

 

Allow authenticated users to create new computer accounts. This approach might be desirable in organizations where users can be largely trusted. However, if you only want to trust a limited group of users, such as developers, for example, to create new computer accounts, you can control this by using the Security Configuration Manager to either assign or deny this right to users. By default, authenticated users are assigned the Add workstations to domain user right on the Group Policy object on domain controllers. This enables them to create up to 10 computer accounts in the domain by using the Network Identification Wizard. The wizard requests information about the computer name, the domain or workgroup that the computer is joining, and the domain users that are to be added to the local groups for local computer access, and uses this information and the credentials of the authenticated user to create a new account in Active Directory.

 

Ben

[Jamman960]

Hmm I've just checked our domain security pol(Administrative tools> Domain Security Policy > Local Policys > User Rights Assignment) and the default is indeed to allow users to create 10 computer accounts. This can be secured by configuring the policy option with users/groups that are to be permitted to create computer accounts.

 

It may also need changing within the Default Domain Controller Security Policy.

 

Think I'll have to take a closer look at the pols... I really wasn't expecting anything like that to be the default option argh

 

James

Edited November 4, 2009 by Jamman960

[dhicks]

By default, authenticated users are assigned the Add workstations to domain user right on the Group Policy object on domain controllers.

 

Wait, what? You mean that, by default, standard network users can add machines to a domain?

 

--

David Hicks

[SC-UK]

Wait, what? You mean that, by default, standard network users can add machines to a domain?

 

--

David Hicks

 

Yup!

[dhicks]

Yup!

 

!???!! #@**@#!!!

 

--

David Hicks

[SC-UK]

Couldn't have put it better myself!

[Gatt]

Prevent users from adding computer to domain in Server 2003 - Active Directory

 

This seems to suggest a few options - should work on Server 2008 as well as 2003...

[plexer]

Indeed by default any user can add 10 machines.

 

Ben

[maniac]

I thought this was a well known security issue in Server 2003, I've always known about it, and restrict my network by specifying the groups that are allowed to add machines to the domain in the default domain controllers policy.

[Chuckster]

I've now since disabled all users apart from Administrators from adding computers to the domain.

[cookie_monster]

Wait, what? You mean that, by default, standard network users can add machines to a domain?

 

--

David Hicks

 

 

Yep I remember reading an interview with an MS employee who worked on the AD design team. They just decided on a number out of the blue, he had a reason for it that I can't remember now but I remember laughing at it.

Surely it would be 0 by default with an option to enable it. BUT it's not a security flaw it was a 'thought' out design decision.

[maniac]

BUT it's not a security flaw it was a 'thought' out design decision.

 

OK, it's a design flaw then. Which ever way you look at it, it's a little bit daft.

[Ben-BSH]

Well, thanks all, and I'm glad I brought up an issue which other people now are aware of!

 

and who said Microsoft courses were useless!

[cookie_monster]

OK, it's a design flaw then. Which ever way you look at it, it's a little bit daft.

 

 

I feel it is as well but as I say MS had a reason for it (I'll try to find the article) and this reason prevented them from changing it in 2003 and 2008 server (or did they finally change it in 2008).

 

I seem to remember the rational was that they didn't feel that adding a computer account presented an issue as their user account would still have policy and restrictions applied, they also couldn't move the computer account from the default computers container to receive software or station specific settings as they wouldn't have that right. I'm assuming that they weren't factoring in virus issues.

Edited November 4, 2009 by cookie_monster

[dhicks]

Yep I remember reading an interview with an MS employee who worked on the AD design team. They just decided on a number out of the blue, he had a reason for it that I can't remember now but I remember laughing at it.

 

Hang on, sudden thought: does a user with a Windows XP Home or similar machine connecting to a network file share count as "joining" a domain?

 

--

David Hicks

[DMcCoy]

Hang on, sudden thought: does a user with a Windows XP Home or similar machine connecting to a network file share count as "joining" a domain?

 

--

David Hicks

 

If they authenticate, then a CAL is probably required.

[ajbritton]

Surely user would need to be local Admin on the PC to add it to domain.

 

The way I understood this setup was that although user is allowed to add a computer to the domain, the computer account would have to already have been created. Has anyone actually tested this?

[cookie_monster]

Hang on, sudden thought: does a user with a Windows XP Home or similar machine connecting to a network file share count as "joining" a domain?

 

--

David Hicks

 

 

I don't think XP Home is allowed by licence to access a domain so by doing it you would be breaking the licence terms anyway. (Don't quote me on that you have to check the EULA)

[Michael]

This has been a 'feature' since Server 2003, so ironically I think 2000 Server (in this situation) is actually more secure by default. I agree the default value should be zero as I've never allowed staff or pupils to join the domain.

 

Windows XP Home cannot join a domain but only a workgroup, so there's no problem here. If you right click - My Computer > Properties > Computer Name (tab) you can compare the differences between Home and Pro.

You can still map network drives and access shares on a domain from XP Home, but you'd typically need to authenticate everytime; DOMAINNAME\USERNAME

[cookie_monster]

This has been a 'feature' since Server 2003, so ironically I think 2000 Server (in this situation) is actually more secure by default. I agree the default value should be zero as I've never allowed staff or pupils to join the domain.

 

Windows XP Home cannot join a domain but only a workgroup, so there's no problem here. If you right click - My Computer > Properties > Computer Name (tab) you can compare the differences between Home and Pro.

You can still map network drives and access shares on a domain from XP Home, but you'd typically need to authenticate everytime; DOMAINNAME\USERNAME

 

 

It was an original Active Directory design decision and was present in Windows 2000

 

Windows 2000 grants the "Add workstations to domain" privilege to the Authenticated Users group by default. When this privilege is enabled, authenticated users can bypass the access control list (ACL) check for up to a predefined maximum value. To prevent misuse, the maximum number of machine accounts any authenticated user can join is 10 by default.

 

Domain Users Cannot Join Workstation or Server to a Domain