Delegation/Joining Machines to a Domain: Difference between revisions

From SambaWiki
m (fixed typo in a code tag)
 
(One intermediate revision by one other user not shown)
Line 15: Line 15:
* Create a new group <code>supporters</code>.
* Create a new group <code>supporters</code>.


* Right-click to the <code>cn=Computer</code> container and select <code>Delegate control</code>.
* Right-click to the <code>Computer</code> container and select <code>Delegate control</code>.


* Click <code>Next</code>.
* Click <code>Next</code>.
Line 21: Line 21:
* Click <code>Add</code> and select the group <code>supporters</code> and click <code>Next</code>.
* Click <code>Add</code> and select the group <code>supporters</code> and click <code>Next</code>.


* Select <code>Create a custom task to delegate</code>.
* Select <code>Create a custom task to delegate</code> and click <code>Next</code>.


* Select <code>Only the following objects in the folder</code> and check <code>Computer objects</code> from the list. Additionally select the options <code>Create selected objects in the folder</code> and <code>Delete selected objects in this folder</code>. Click <code>Next</code>.
* Select <code>Only the following objects in the folder</code> and check <code>Computer objects</code> from the list. Additionally select the options <code>Create selected objects in the folder</code> and <code>Delete selected objects in this folder</code>. Click <code>Next</code>.


* Select <code>General</code> and <code>Property-specific</code>, select the following permissions from the list and click <code>Next</code>.
* Select <code>General</code> and <code>Property-specific</code>, select the following permissions from the list.
:* <code>Reset password</code>
:* <code>Reset password</code>
:* <code>Read and write account restrictions</code>
:* <code>Read and write account restrictions</code>
Line 32: Line 32:
:* <code>Validated write to service principal name</code>
:* <code>Validated write to service principal name</code>
:* <code>Write servicePrincipalName</code>
:* <code>Write servicePrincipalName</code>

* Click <code>Next</code>.


* Click <code>Finish</code>.
* Click <code>Finish</code>.


To enable the group to join machines to multiple containers or organizational units (OU), repeat the steps on them.
To enable the group to join machines to multiple containers or organizational units (OU), repeat the steps on them.

A similar way to do the same on the Windows command line is described [https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=48 in this artice].


= Revoking the Delegation =
= Revoking the Delegation =

Latest revision as of 12:16, 28 June 2021

Introduction

Delegating permissions in an Active Directory (AD) enables the administrator to assign permissions in the directory to unprivileged. For example, to enable a help desk employees to join machines to the domain without knowing the domain administrator credentials.



Adding the Delegation

To enable the supporters group to join and remove machines to and from the domain:

  • Open the Active Directory Users and Computers (ADUC) console as domain administrator.
  • Create a new group supporters.
  • Right-click to the Computer container and select Delegate control.
  • Click Next.
  • Click Add and select the group supporters and click Next.
  • Select Create a custom task to delegate and click Next.
  • Select Only the following objects in the folder and check Computer objects from the list. Additionally select the options Create selected objects in the folder and Delete selected objects in this folder. Click Next.
  • Select General and Property-specific, select the following permissions from the list.
  • Reset password
  • Read and write account restrictions
  • Read and write DNS host name attributes
  • Validated write to DNS host name
  • Validated write to service principal name
  • Write servicePrincipalName
  • Click Next.
  • Click Finish.

To enable the group to join machines to multiple containers or organizational units (OU), repeat the steps on them.

A similar way to do the same on the Windows command line is described in this artice.

Revoking the Delegation

To disable members of the supporter group to join and remove machines to and from the domain:

  • Open the Active Directory Users and Computers (ADUC) console as domain administrator.
  • Right-click to the container or organizational unit (OU) you want to revoke the permissions and select Properties.
  • Navigate to the security tab.
  • Remove the supporter group from the list.
  • Click OK.