Re: Permissions to re-join computer to domain

From: Lanwench [MVP - Exchange] (lanwench_at_heybuddy.donotsendme.unsolicitedmail.atyahoo.com)
Date: 02/25/05 

Date: Fri, 25 Feb 2005 10:33:05 -0500

GSDPack wrote:
> I have setup a separate OU that contains about sixty machine
> accounts. I would like to setup the permissions to allow any domain
> user to re-join the machine to the domain.
>
> The scenario we have:
>
> A WindowsXP machine is imaged when problems exist. I most cases the
> machine account is not removed from the domain. A new image is
> brought down from an imaging server and the machine is re-booted.
> During the re-boot the computer name is changed from the image name
> to the original name and re-started.
>
> Here we would like to assign permissions to domain users to re-join
> the computer to the domain. I have tired setting Domain Users
> security on the OU to create/delete computer accounts and created a
> GPO for Domain Users to add machines to the domain.
>
> However when they login as the local Administrator attempt to add the
> machine to the domain they receive "Access is Denied"
>
> Any ideas on the permissions that need to be set?
>
> Thanks.
>
> Lester

Try posting in an AD or Windows group. This group is for Exchange Server.

(Never image a domain-member PC - join the newly created imaged computers to
the domain after running whatever you use to change the SIDs.)

Relevant Pages

  • Re: Domain account iwth restricted rights
    ... Normally the "Authenticated Users" special group has the logon locally ... The Domain Users causes the "Logon Locally" right to be present ... So you need both different permissions and different rights perhaps. ... What is the best way to lock down these accounts? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain account iwth restricted rights
    ... primary group and each was removed from Domain Users. ... The Domain Users causes the "Logon Locally" right to be present ... So you need both different permissions and different rights perhaps. ... What is the best way to lock down these accounts? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain account iwth restricted rights
    ... primary group and each was removed from Domain Users. ... So you need both different permissions and different rights perhaps. ... What is the best way to lock down these accounts? ... REMOVE them from the Domain Users group (every user is a member ...
    (microsoft.public.windows.server.active_directory)
  • Permissions to re-join computer to domain
    ... I have setup a separate OU that contains about sixty machine accounts. ... Here we would like to assign permissions to domain users to re-join the ... I have tired setting Domain Users security on the OU ...
    (microsoft.public.exchange2000.active.directory.integration)
  • Permissions
    ... I can't setup a small office network because my computer ... tells me I don't have permissions to do so. ... accounts. ...
    (microsoft.public.windowsxp.security_admin)