Add PC to domain Problem

[peter.marshall]

I know this has happened to a number of people aready, from reading
past posts, however, I have not been able to fix my problem.

I am trying to give a user in our company the ability to add pc's to
the domain. I have tried 2 ways. The first was to right click on
"Computers" in AD, and give him permissions there. That did not work.
I then tried to edit the domain policy, and give him the abilites
throught the "add Pc's to the domain" option.. That also did not work.

In both cases, I tried to add the group that contains his name, and
then tried simply adding his name.

I read that every user should be able to add up to 10 machines to the
domain. That is not the case here. (I became the admin here after the
domain was already set up .. ) I am not sure where that setting is (I
do not want to turn it off, however was also wondering if this could be
causeing part of the problem).

One last thing. I just upgraded our domain controllers from win2k
server, to win 2003 server last week. I am not sure if this could be
part of the problem. I did not try to give him permissions when we had
the win 2k server, so I do not know if it worked then,

Thank you for any input,

Peter

 

[Miha Pihler [MVP]]

Hi Peter,

The thing with the policy "Add workstations to domain" is to set it up on
Default Domain Controller Policy and not on Default Domain Policy.

Add workstations to domain
http://www.microsoft.com/technet/pr...elp/7207aa3e-d95d-4176-a1ca-bc629f1ca698.mspx

Don't give users permissions to Computers Container since there could be a
security issue with this.

 

[peter.marshall]

I am a bit of a nube on this one .. How do I add a "Default Domain
Controller Policy" as opposed to a default domain policy ?

Thank you for your reply,

Peter

 

[peter.marshall]

I found the option ... Start -> Control Panel -> Administrative tools
-> Domain Controller Security Policy.

I Defined the policy here (and un-defined it under Default Domain
Policy) .. and still nothing. I also put the permissions back the way
they were on the computers OU. I read on that link you sent me that it
was a possilbe security concern to have users add computers from there
... I assume that is because they have ownership of the objects instead
of the domain admin. It still should have worked though right ? No
matter. Is there something I have to do to apply that policy I made
under the Default Domain Controller Policy ?

On an aside, Do you know a place I can read that will tell me the
difference between adding permissions to different policies in
different locations (ie. what is the difference of adding permisions
to the default domain policy as opposed to the default domain
controller policy ?)

(I am more concerned about just getting this one user to be able to add
computers to the domain .. so if you only have time to answer one of my
questions, I would much prefer this one).

Thank you again,

Peter

 

[Miha Pihler [MVP]]

What is the error that you get when you try to add computer to domain?

 

[peter.marshall]

The following error occured when atempting to join the domain
"domainname"
Access denied

Thank you,
Peter