GPO and Add Computer to Domain

[Russ]

We're using GPOs to apply security group restrictions to add groups to
the local admin accounts on workstations, but we're having problems
with remote sites adding computers to our AD domain. We have an OU
set up for them, and they're delegated permissions to their OU, but
when they try to join a new PC, they are denied. I'm guessing it is
trying to put it in the default computer container instead of their
OU, which they don't have rights to. How do we fix this (script?)
this so our site admins can join PCs to their OUs remotely?

 

[Matjaz Ladava [MVP]]

Make them prestage computer accounts in their OU prior to joining computers
to the domain. dsadd command line tool has this ability. It is included as
part of Windows Server 2003 adminpak.

--
Regards

Matjaz Ladava, MCSE (NT4 & 2000), Windows MVP
(e-mail address removed)
http://ladava.com