Delegating renaming a computer account

[Jerame]

I have delegated the right to add and delete computer
objects for our helpdesk to a particular OU in our Win2K3
domain.

I am told that they can not rename a computer that has
already been added to the domain. I have verified this to
be true. They do have local admin access to the
workstation.

Doing some research, I've read that you need to delegate
rename rights to the computer objects. I have been
unsuccessful in finding this.

I also came across a ms document that stated giving a
user "add computer rights to the domain" automatically
gave them rename rights, and that that was a problem and
going to be fixed in Windows 2000 SP3.

Can someone point me in the right direction?

TIA,
Jerame

 

[Dmitry Korolyov [MVP]]

You must grant them permission to have full control, on computer accounts
only. You can set this permission at the OU level and it will be applied to
all computer accounts in the OU and down the OU hierarchy.
Or, you can set more precise permissions by giving your techs rights to
modify cn attribute of the computer accounts in the OU.

--
Dmitry Korolyov [[email protected]]
MVP: Windows Server - Active Directory


I have delegated the right to add and delete computer
objects for our helpdesk to a particular OU in our Win2K3
domain.

I am told that they can not rename a computer that has
already been added to the domain. I have verified this to
be true. They do have local admin access to the
workstation.

Doing some research, I've read that you need to delegate
rename rights to the computer objects. I have been
unsuccessful in finding this.

I also came across a ms document that stated giving a
user "add computer rights to the domain" automatically
gave them rename rights, and that that was a problem and
going to be fixed in Windows 2000 SP3.

Can someone point me in the right direction?

TIA,
Jerame