Return
-
Title
HOW TO: Join computers to a Domain using Active Roles -
Description
A delegate is able to add computer account using the New-QADComputer cmdlet but see an access denied error when joining computer account to domain. However, if the computer account is created under another OU with permissions applied through native security, that same delegate is able to add a computer account using New-QADComputer cmdlet and join computer account to domain.
- Is providing Full Control delegation access for computer objects not enough to join a computer account to the domain?
- How can this be achieved?
-
Resolution
WORKAROUND
Grant permissions in Active Directory.Note: Due to the changes needing to be done locally on a machine to join a computer to a domain, Active Roles is not capable of joining a computer to a domain. The most that can be done here is during staging of a computer object in AD prior to joining, you can configure which user or group has access to join the computer to the domain. This can be done in the web interface and is in the default form when creating a new computer object. Once the object is created and the user/group was set during the object creation, that user (or user in the group) will have permissions to go through the steps on the local machine to add it to the domain. -
Additional Information
https://blogs.technet.microsoft.com/dubaisec/2016/02/01/who-can-add-workstation-to-the-domain/