Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In a course about Windows Server administration that I took at the university they told us that a normal user could add 10 computers to a domain. Over the years however I've added and removed way more than 10 computers (virtual machines included) to the domain without any problems, while some colleagues of mine swear that they can't add any computers. My account is not priviledged in any aspect, I'm just a regular user like everyone else.

So... what are the rules governing this? Can they be changed by the admin? Is there any way I can find out with my user-level-priviledges?

Just curious. :)

share|improve this question

2 Answers 2

By default, any authenticated user can add up to 10 new computers to the domain.

This is controlled by the "Add workstations to domain" right, which can be found in the security policy under "Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\".

Typically, this would be changed by the sysadmin when the domain is created in order to restrict this right to a specific group, usually "DOMAIN\Administrators".

I can only guess what is happening in your situation, it's either:

  • You are a domain admin and don't realise it.
  • Your environment has specified a custom group for this right and you are in that group.
  • Something else I haven't thought of. ;-)

For reference, here's what TechNet has to say about "Add workstations to domain".

share|improve this answer
    
Whow, is that stil lvalid? That is pretty much the biggest stupid security risk I have ever seen. –  TomTom Mar 11 '10 at 12:07
    
It is still there in 2003. And I'd say that the bigger risk is tasking people who don't know AD really well with maintaining it. –  ThatGraemeGuy Mar 11 '10 at 12:12
    
Wait, hmm... does this mean that I can do the "add workstation" thing only 10 times, or that I can have only 10 workstations added at any moment, but if I remove some then I can add some more again? –  Vilx- Mar 11 '10 at 12:28
    
Wait wait wait...has anyone tested it recently? Why is it that I get fifty UAC popups for trying to update my antivirus, but this is saying that I can add any rogue VM or laptop to a domain that I'm a member of (or has generic user accounts for groups of people)? Am I the only one that would think that this is a little against the least-privilege principal for rights assignment? Or is there a valid reason to have this as a default? –  Bart Silverstrim Mar 11 '10 at 12:35
    
How does this create a security risk? A computer as-per-se doesn't have any more rights in the domain when it's added. It's the logged-on user that has rights in the domain. No? –  Vilx- Mar 11 '10 at 12:42

In order to add a computer to a Windows domain, your ID needs a few permissions:

Create/modify computer objects / Change password

and maybe one or two others.

Check your account and you'll probably find that, somewhere, these permissions (or more) are set.

share|improve this answer
1  
Nope, all you need is the Add workstations to domain right, which is given to Authenticated Users by default, for up to 10 PC's –  Sam Mar 11 '10 at 13:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.