How to Prevent Authenticated Users from joining Workstations to a Domain


بسم الله الرحمن الرحيم

I asked myself what is benefit from this option “by default, Windows Server allows authenticated users to join 10 machine accounts to the domain”. But I didn’t get an answer

Administrator can control it with two ways:

1-By Adsiedit:

  • Start – Administrative Tools – ADSI Edit
  • Right click Domain Name – Properties
  • Attribute Editor Tab – ms-DS-MachineAccountQuota – Click Edit – set to 0 –press ok

Pic01

Pic02

Pic03

Pic04

Note:

That users in the Administrators or Domain Administrators groups, and those users who have delegated permissions on containers in Active Directory to create and delete computer accounts, are not restricted by this limitation.

2-By Group Policy:

  • Click Start – All programs – Administrative Tools – Group Policy Management.
  • Create or Edit Group Policy Objects.
  • Expand Computer Configuration – Policies – Windows Settings – Security Settings – User Rights Assignment
  • From right pane right click on Add workgroup to domain – Properties – Add User or Group or remove unwanted user or group

Pic05

 Pic06

Advertisements

About Mohamed Abd Elhamid

Microsoft System Administrator

Posted on November 9, 2011, in Group Policy, HOW TO ? and tagged , , , . Bookmark the permalink. 4 Comments.

  1. 2. Do I have apply these settings on Domain Policy or Domain Controller Policy?

  2. As salaamu alaikum. Its nice to see some other people finding this problem. One other possible solution to this is redirecting the default computers container to a different OU. I think in that case, the method that allows standard users to create computer objects fails. There are some security concerns with the ability to create computer accounts, you can check out some of my work on this at my blog http://myitpath.blogspot.com/2010/05/creating-infinite-semi-anonymous.html

  3. Thanks for comment and nice blog

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: