GP -- adding workstation to domain

[Guest]

Hello ,

While working for our corporate client, I discovered security
misconfiguration:

-- Regular users can add workstations to domain
I've tried to fix it up by going to default domain gpo -- computer
configuration -- windows settings -- security settings -- local policies --
User rights assignment.

In the list of user rights i changed setting of "Add workstation to domain"
to
Administrators, Enterp. admins and domain admins groups only.

I wait some time for replication to occur.

The I tested the new setting -- it didn't work, users still able to add
computers to domain.
Any ideas why?

I will be very grateful for your help.
Thanks,
Gary

 

[Sergio Fonseca [MVP]]

Hi,

Check this articles:

http://www.microsoft.com/resources/...dowsServ/2003/standard/proddocs/en-us/526.asp

http://support.microsoft.com/kb/251335/EN-US/

I would set the ms-DS-MachineAccountQuota to 0.

Qualquer sugestão deve ser testada antes de aplicada - www.gupade.org

 

[Guest]

Hello Sergio,

How can I can I restrict the right to specific groups only?
Thanks,
Gary

 

[Sergio Fonseca [MVP]]

Hi,

You are able to do it for example with ACL´s in the "Computers" container.

Qualquer sugestão deve ser testada antes de aplicada - www.gupade.org