Delegation/Joining Machines to a Domain: Difference between revisions
From SambaWiki
Mmuehlfeld (talk | contribs) m (Mmuehlfeld moved page Delegation/Join machines to a domain to Delegation/Join Machines to a Domain: Change title to TitleCase) |
|||
(7 intermediate revisions by 3 users not shown) | |||
Line 1: | Line 1: | ||
= |
= Introduction = |
||
Delegating permissions in an Active Directory (AD) enables the administrator to assign permissions in the directory to unprivileged. For example, to enable a help desk employees to join machines to the domain without knowing the domain administrator credentials. |
|||
In the following we'll explain how you delegate permission for joining computers to the domain to members of a non-domain-admin-group. This delegation should only be set on the default container for machine accounts (CN=Computers). |
|||
''Side note: By default, the 'authenticated users' group can join up to 10 workstations to the domain. This can be a security risk and you should think about deactivating this!'' |
|||
⚫ | |||
* Create a new group 'supporters' and add user accounts to it, who should later be able to join machines to the domain. |
|||
* Right-click to CN=Computers and click 'Delegate control' to open the delegation wizzard. |
|||
= Adding the Delegation = |
|||
⚫ | |||
To enable the <code>supporters</code> group to join and remove machines to and from the domain: |
|||
⚫ | |||
⚫ | |||
⚫ | |||
* Create a new group <code>supporters</code>. |
|||
⚫ | |||
* Right-click to the <code>Computer</code> container and select <code>Delegate control</code>. |
|||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
* Click |
* Click <code>Next</code>. |
||
⚫ | |||
⚫ | |||
⚫ | |||
After you finished these steps, members of the 'supporter' group will be able to join computers to the domain. |
|||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
= Revoke delegation = |
|||
⚫ | |||
If you want to revoke the permission for the 'supporter' group again, follow these steps: |
|||
To enable the group to join machines to multiple containers or organizational units (OU), repeat the steps on them. |
|||
⚫ | |||
A similar way to do the same on the Windows command line is described [https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=48 in this artice]. |
|||
⚫ | |||
= Revoking the Delegation = |
|||
To disable members of the <code>supporter</code> group to join and remove machines to and from the domain: |
|||
⚫ | |||
⚫ | |||
⚫ | |||
* Navigate to the <code>security</code> tab. |
|||
* Remove the <code>supporter</code> group from the list. |
|||
⚫ | |||
---- |
|||
[[Category:Active Directory]] |
Latest revision as of 12:16, 28 June 2021
Introduction
Delegating permissions in an Active Directory (AD) enables the administrator to assign permissions in the directory to unprivileged. For example, to enable a help desk employees to join machines to the domain without knowing the domain administrator credentials.
Adding the Delegation
To enable the supporters
group to join and remove machines to and from the domain:
- Open the
Active Directory Users and Computers
(ADUC) console as domain administrator.
- Create a new group
supporters
.
- Right-click to the
Computer
container and selectDelegate control
.
- Click
Next
.
- Click
Add
and select the groupsupporters
and clickNext
.
- Select
Create a custom task to delegate
and clickNext
.
- Select
Only the following objects in the folder
and checkComputer objects
from the list. Additionally select the optionsCreate selected objects in the folder
andDelete selected objects in this folder
. ClickNext
.
- Select
General
andProperty-specific
, select the following permissions from the list.
Reset password
Read and write account restrictions
Read and write DNS host name attributes
Validated write to DNS host name
Validated write to service principal name
Write servicePrincipalName
- Click
Next
.
- Click
Finish
.
To enable the group to join machines to multiple containers or organizational units (OU), repeat the steps on them.
A similar way to do the same on the Windows command line is described in this artice.
Revoking the Delegation
To disable members of the supporter
group to join and remove machines to and from the domain:
- Open the
Active Directory Users and Computers
(ADUC) console as domain administrator.
- Right-click to the container or organizational unit (OU) you want to revoke the permissions and select
Properties
.
- Navigate to the
security
tab.
- Remove the
supporter
group from the list.
- Click
OK
.