How to restrict a domain account to only allow join workstations

[fs483]

Hello,

I'm trying to figure out how I can restrict a domain account that will be allowed to join workstations to a domain. We want to allow one of the more knowledgeable employees to be able to join workstations to a domain yet we don't want him to have full admin privileges. How can we do that ?

Thanks
akwong

 

[markdmac]

Create an OU and delegate rights to that OU to the user. You can choose to add machines in the Custom Delegation settings.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[58sniper]

BTW - IIRC, user accounts already have the ability to add up to 10 workstations to the domain.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[fs483]

How about restricting junior admins to certain functions like unlocking accounts, resetting passwords ?

 

[markdmac]

Akwong, you need to run the delegation wizard and look at the options there.

An alternative is to use ASP pages that have admin rights. Use NTFS permissions to restrict who has access to the pages. I've done this for a number of customers. It allows me to give non-admins specific abilities through custom tools rather than assigning their IDs elevated rights.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.