Member Avatar for Samerases

Hello,,,

how to Denying users the ability to join computers to domain?

any one show me the way plz......

  • 2 Contributors
  • 2 Replies
  • 104 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by Samerases

Dani AI

Generated

For : is right — there are two commonly used, reliable approaches. Short summary and practical guidance so the change can be applied safely.

One (global) option is to set the domain machine-account quota to zero. By default Authenticated Users can create up to 10 computer accounts. Check the current value with the Active Directory PowerShell module:

Get-ADDomain | Select-Object Name,MachineAccountQuota

To change it you can edit the domain object (for example with ADSIEdit) and set the machine-account-quota attribute to 0. That prevents ordinary users from creating new computer accounts across the domain. Important: test first, and pre-stage or delegate computer accounts for any automated deployments before you flip this, because it is a global change.

The other (preferred for most orgs) is to tighten ACLs and use delegation per OU. Steps: enable ADUC -> View -> Advanced Features -> right-click the Computers container or the specific OU -> Properties -> Security -> Advanced. Remove or deny the "Create computer objects" permission for Authenticated Users and then run the Delegation of Control wizard to give a limited group (for example "Domain Joiners") the explicit right to create computer objects in that OU. This lets you control who can join machines and keeps the rest of AD permissions intact.

Cautions and troubleshooting: always test in a lab, document any ACL or attribute change, and keep a Domain Admin account available to revert. The quota change is quick and global; ACL/delegation is finer-grained and auditable — pick the one matching your environment and automation needs.

Recommended Answers

All 2 Replies

Member Avatar for Samerases

thanks JorgeM

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.