group policy 2

[Fabit]

Is there a policy that I can let users add computers to a domain. and if there is? what is the name of it under active directory group policy?

most appreciate,

 

[bran2235]

You would need to use the "Delegate Control" tool and give appropriate permissions. I believe you would do this in the default "Computers" container... not 100% sure... Hope this helps-
Brandon

 

[Fabit]

I went to delegates added the users that I want to delegate control to and clicked next and I saw a whole bunch of options. I just want to give the users I picked the right to add computers to domains not change anything in active directory. what do you think I should pick?

 

[Roadki11]

Create a new security group, add the users you want to have the authority to add machines to the domain. then open the Default Domain Controllers policy. Expand Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ User Rights Assignment. Edit the policy "Add Workstations to the Domain". Add the the new security group here and you should be good. It probably already has the authenticated users group applied, this is a bit of a problem as outlined in the following post:

http://www.tek-tips.com/viewthread.cfm?qid=1336584&page=1

RoadKi11

 

[Fabit]

Ok here is what I did. I added an organizational unit to my ad and I placed the two users in there. Then I edited the default group policy under that organizational unit and added to that policy called "add Workstations to the Domain" It is still not working. the user are still not able to computers to the domain.

 

[Roadki11]

Im sure you can only do this at the "Default Domain Controllers Policy", probably wont work from a sub OU.

RoadKi11

 

[Fabit]

I did not now about the security problem by microsoft thank you, but I know they tried joining computers in the defualt domain policy and it worked for a couple of days and it stoped working for them. Now, I need them to do it and I added the policy, but it is still not working.

 

[tfg13]

Fabit, are you sure you are enforcing that policy? I wouldn't play with the default policies too much though. Could create problems as explained here:

faq329-6116

Just make sure the policy is enforced, if necessary, you may need to "gpupdate /force" on domain members (computers) for the settings to take place immediately (reboot may be required).