Delegation/Joining Machines to a Domain

From SambaWiki
Revision as of 16:00, 2 September 2016 by Mmuehlfeld (talk | contribs) (Rewrote guide. Rephrased guide to be clearar)

Introduction

Delegating permissions in an Active Directory (AD) enables the administrator to assign permissions in the directory to unprivileged. For example, to enable a help desk employees to join machines to the domain without knowing the the domain administrator credentials.



Adding the Delegation

To enable the "supporters" group to join and remove machines to and from the domain:

  • Open the "Active Directory Users and Computers" (ADUC) console as domain administrator.
  • Create a new group "supporters".
  • Right-click to the "cn=Computer" container and select "Delegate control".
  • Click "Next".
  • Click "Add" and select the group "supporters" and click "Next".
  • Select "Create a custom task to delegate".
  • Select "Only the following objects in the folder" and check "Computer objects" from the list. Additionally select the options "Create selected objects in the folder" and "Delete selected objects in this folder". Click "Next".
  • Select "General" and "Property-specific", select the following permissions from the list and click "Next".
  • "Reset password"
  • "Read and write account restrictions"
  • "Read and write DNS host name attributes"
  • "Validated write to DNS host name"
  • "Validated write to service principal name"
  • "Write servicePrincipalName"
  • Click "Finish".

To enable the group to join machines to multiple containers or organizational units (OU), repeat the steps on them.



Revoking the Delegation

To disable members of the "supporter" group to join and remove machines to and from the domain:

  • Open the "Active Directory Users and Computers" (ADUC) console as domain administrator.
  • Right-click to the container or organizational unit (OU) you want to revoke the permissions and select "Properties".
  • Navigate to the "security" tab.
  • Remove the "supporter" group from the list.
  • Click "OK".