Join domain requirement

ckwong19802003@yahoo.com · Guest

hi

Will like to ask what will be the join pc to the domain requirement accept
from giving full administrator.Kindly advise

wickydog · Guest

Hi,

Actually you have no need to give a full administrator to the pc. The PC is
only required to have a network connection to the Domain Controller and you
have the privilege to join this computer in the domain. Or you can using
Domain Administrator to create a computer account in the DC, then delegate a
domain user to join.

Thanks and Regards
Jacky

"ckwong19802003@yahoo.com" wrote:

ckwong19802003@yahoo.com · Guest

hi,

Is that mean use the domain admin to create the computer object and then on
the pc grant the user as the local admin?Kindly advise

"wickydog" wrote:

Jorge de Almeida Pinto [M · Guest

see:
http://blogs.dirteam.com/blogs/jorge/archive/2006/01/05/369.aspx

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx
-----------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
-----------------------------------------------------------------------------

-----------------------------------------------------------------------------
<ckwong19802003@yahoo.com> wrote in message
news:96D10D4C-7709-41C3-96C0-2BBA24F148AA@microsoft.com...

Richard Mueller · Guest

Hi,

I have a sample VBScript program that grants the permissions required to
join a computer to a domain:

http://www.rlmueller.net/JoinComputer.htm

The link lists the 4 permissions required. They are granted on the computer
object. You can give the permissions to a group or user. You can do it
manually in ADUC.

--
Richard
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net

"Jorge de Almeida Pinto [MVP]"
<SubstituteThisWithMyFullNameSeparatedByDots@gmail.com> wrote in message
news:uKECYWndGHA.3348@TK2MSFTNGP03.phx.gbl...

ckwong19802003@yahoo.com · Guest

hi,

is that we can define the normal user to join domain.Kindly advise

"Richard Mueller" wrote:

Richard Mueller · Guest

Hi,

Yes, if you grant the 4 permissions, a normal user (with no other admin
rights) can join the computer to the domain.

You can also use the Delegation of Control wizard to grant permission to a
user or group to join any computer in an OU to the domain. See this link:

http://www.microsoft.com/windows2000/en/advanced/help/default.asp?url=/windows2000/en/advanced/help/sag_RIS_pro_Join_Domain_Computers.htm

Also, when computer objects are created in ADUC you have the option of
granting a user or group permission to join the object to the domain. The
GUI then grants the same 4 permissions listed in my previous link to the
selected user or group.

--
Richard
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net

<ckwong19802003@yahoo.com> wrote in message
news:E8785F4A-8457-4D3A-83BD-217057B176DD@microsoft.com...

wickydog · Guest

Hi,

Yes, when you create a computer account, it can have a location to specify
who can join this computer to domain, only if the computer name is correct
and the user name is correct, you can use this account to join the specific
machine into domain.

Thanks and Regards
Jacky

"Richard Mueller" wrote:

ckwong19802003@yahoo.com · Guest

hi,

is that work like in the nt4 technology, in the sence of
1)create computer object in the active directory using domain admin
2)delegate the task to add computer object to a respective user

Is this what do you mean?

"wickydog" wrote:

rpeirce · Guest

I have a user who successfully joined a computer to the domain on which
he has local admin rights, but the used his domain user account to join
it. However, the user has no Domain Admin rights or Enterprise Admin
rights. How was the user able to join this to the domain with being a
member of either of these groups?

--
rpeirce
------------------------------------------------------------------------
rpeirce's Profile: http://forums.techarena.in/member.php?userid=15308
View this thread: http://forums.techarena.in/showthread.php?t=511411

www.techarena.in

Jorge de Almeida Pinto [M · Guest

each authenticated user is allowed to add up to 10 clients to an AD domain.
= default!

see:
http://blogs.dirteam.com/blogs/jorge/archive/2006/01/05/369.aspx
section 1

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx
-----------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
-----------------------------------------------------------------------------

-----------------------------------------------------------------------------
"rpeirce" <rpeirce.280ebv@DoNotSpam.com> wrote in message
news:rpeirce.280ebv@DoNotSpam.com...

rpeirce · Guest

Thanks for your help. There are so many GPO's to sort through. I was
able to find the GPO with your help and remove the Authenticated Users
group. I am really surprised that this is permitted by default.

--
rpeirce
------------------------------------------------------------------------
rpeirce's Profile: http://forums.techarena.in/member.php?userid=15308
View this thread: http://forums.techarena.in/showthread.php?t=511411

www.techarena.in