Permission to Add PC's to a domin.

[Stuart_C]

How do I give a user (or group) permissions to add PC's to my domain?

 

I don't want to make the account a domain admin but it needs the ability to add more than the default 10 accounts to the domain.

 

My guess is that I define it in the Group Policy under Computer Config=>Policies==>WinSetting==>Security Setting==>Local Policis==>User Rights Assignemnt==> Add workstations to the domain.

 

If that's the case I'm not sure whether it should be applied to the Domain (Default Domain Policy) the DC's (Default DC Policy) or whether i can just add it to the OU where I am creating the computer accounts. And I don't want to muck anything up.

[FN-GM]

That goes in the default DC policy. You also need to delegate rights in AD. If you can wait a few hours i have a good link about this on my laptop at home.

[cpjitservices]

Delegate rights in AD, that does it!

[FN-GM]

Delegate rights in AD, that does it!

 

Both is required. The deligation allows you to overwrite existing AD computer accounts. Without that if you try to join a machine to the domain when the computer object already exists it will give access denied

[Stuart_C]

That goes in the default DC policy. You also need to delegate rights in AD. If you can wait a few hours i have a good link about this on my laptop at home.

 

That would be great if you can.

[MatthewL]

Domain Users by default always used to be able to add so many machines onto the domain.

[FN-GM]

These are the delegated rights needed to overwrite existing computers: Error message when non-administrator users who have been delegated control try to join computers to a Windows Server 2003-based or a Windows Server 2008-based domain controller: "Access is denied"

 

You also need to make sure the user or group is allowed in the default DC policy

[Arthur]

The following article describes how to give an account (or group in your case) the bare minimum permissions required to join computers to a domain.

 

Creating a JoinDomain account for use with SCCM OSD « CoreTech

[Stuart_C]

Domain Users by default always used to be able to add so many machines onto the domain.

 

They can add up to 10. Bit of an issue when I need an account for deploying PC's with and have to include the username and a password in an ini file...