Home / server / Questions / 121448
In Process
Vilx-
Asked: 2010-03-12 03:48:02 +0800 CST

How many times can a simple user add a computer to windows domain?

  • 772

In a course about Windows Server administration that I took at the university they told us that a normal user could add 10 computers to a domain. Over the years however I've added and removed way more than 10 computers (virtual machines included) to the domain without any problems, while some colleagues of mine swear that they can't add any computers. My account is not priviledged in any aspect, I'm just a regular user like everyone else.

So... what are the rules governing this? Can they be changed by the admin? Is there any way I can find out with my user-level-priviledges?

Just curious. :)

active-directory permissions

2 Answers

  1. By default, any authenticated user can add up to 10 new computers to the domain.

    This is controlled by the "Add workstations to domain" right, which can be found in the security policy under "Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\".

    Typically, this would be changed by the sysadmin when the domain is created in order to restrict this right to a specific group, usually "DOMAIN\Administrators".

    I can only guess what is happening in your situation, it's either:

    • You are a domain admin and don't realise it.
    • Your environment has specified a custom group for this right and you are in that group.
    • Something else I haven't thought of. ;-)

    For reference, here's what TechNet has to say about "Add workstations to domain".

    • 6

  2. In order to add a computer to a Windows domain, your ID needs a few permissions:

    Create/modify computer objects / Change password

    and maybe one or two others.

    Check your account and you'll probably find that, somewhere, these permissions (or more) are set.

    • 0