Create an account for the sole purpose of adding computer accounts

[SA]

Hi all,
I am in the middle of an Active directory roll-out and I wanted to create an
account with the express purpose of adding computer accounts for the
helpdesk. These are the questions I have:
1) Are there any major issues with this approach.
2) What do I need to edit for this account to overcome the 10 computer
account addition limit?
3) Also what can I do to make sure that all this account can do is add
computer accounts and nothing else?

Thanks and BTW it is a Windows 2003 AD infrastructure.
-SA.

 

[Jerold Schulman]

Hi all,
I am in the middle of an Active directory roll-out and I wanted to create an
account with the express purpose of adding computer accounts for the
helpdesk. These are the questions I have:
1) Are there any major issues with this approach.
2) What do I need to edit for this account to overcome the 10 computer
account addition limit?
3) Also what can I do to make sure that all this account can do is add
computer accounts and nothing else?

Thanks and BTW it is a Windows 2003 AD infrastructure.
-SA.

See tip 8144 in the 'Tips & Tricks' at http://www.jsiinc.com and links.



Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com

 

[SA]

Jerold,
Thanks for the quick response. Is there anyway to change the
DS=machineaccountquota for just one user?
Iioiiiiiidgdfgdfgdfgdfgdfgdfgdgdg
machineaccoutnquotaStuart Morrison

 

[Eric Chamberlain, CISSP]

For better accountability, you should not have a shared account for the help
desk. Just grant the help desk group the right to add workstations to the
domain. Each help desk member would then use their standard logon when
creating computer accounts. You can then change the account addition default
to zero.