Add workstations to Domain rights?

[mouser]

In starting a job with a new company, I've taken over the
Windows network that consists of 1 A.D. Forest with the
root domain and 4 child domains. I've found that for some
reason, every user account in the Forest has the ability
to add workstations to the domain using any user
credentials. I've checked all Group Policy settings to
make sure that nobody is listed under the "Add
Workstations to Domain" (under User Rights Assignments)
and it shows on all GPO's as "Not Defined".

What else would give all users in the child domains this
ability??

 

[Cary Shultz [MVP]]

-----Original Message-----
In starting a job with a new company, I've taken over the
Windows network that consists of 1 A.D. Forest with the
root domain and 4 child domains. I've found that for some
reason, every user account in the Forest has the ability
to add workstations to the domain using any user
credentials. I've checked all Group Policy settings to
make sure that nobody is listed under the "Add
Workstations to Domain" (under User Rights Assignments)
and it shows on all GPO's as "Not Defined".

What else would give all users in the child domains this
ability??
.

Unless I am misreading this post, every user can add up to
10 workstations to the domain. This can be changed as
needed.

HTH,

Cary

 

[Ace Fekay [MVP]]

In

Unless I am misreading this post, every user can add up to
10 workstations to the domain. This can be changed as
needed.

HTH,

Cary

Just to add, that can be changed using ADSIEdit. It's in the DomainNC
properties (IIRC).

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory