up vote 6 down vote favorite
1
share [g+] share [fb]

In a course about Windows Server administration that I took at the university they told us that a normal user could add 10 computers to a domain. Over the years however I've added and removed way more than 10 computers (virtual machines included) to the domain without any problems, while some colleagues of mine swear that they can't add any computers. My account is not priviledged in any aspect, I'm just a regular user like everyone else.

So... what are the rules governing this? Can they be changed by the admin? Is there any way I can find out with my user-level-priviledges?

Just curious. :)

link|improve this question
50% accept rate
feedback

3 Answers

up vote 5 down vote

By default, any authenticated user can add up to 10 new computers to the domain.

This is controlled by the "Add workstations to domain" right, which can be found in the security policy under "Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\".

Typically, this would be changed by the sysadmin when the domain is created in order to restrict this right to a specific group, usually "DOMAIN\Administrators".

I can only guess what is happening in your situation, it's either:

  • You are a domain admin and don't realise it.
  • Your environment has specified a custom group for this right and you are in that group.
  • Something else I haven't thought of. ;-)

For reference, here's what TechNet has to say about "Add workstations to domain".

link|improve this answer
Whow, is that stil lvalid? That is pretty much the biggest stupid security risk I have ever seen. – TomTom Mar 11 '10 at 12:07
It is still there in 2003. And I'd say that the bigger risk is tasking people who don't know AD really well with maintaining it. – Graeme Donaldson Mar 11 '10 at 12:12
Wait, hmm... does this mean that I can do the "add workstation" thing only 10 times, or that I can have only 10 workstations added at any moment, but if I remove some then I can add some more again? – Vilx- Mar 11 '10 at 12:28
Wait wait wait...has anyone tested it recently? Why is it that I get fifty UAC popups for trying to update my antivirus, but this is saying that I can add any rogue VM or laptop to a domain that I'm a member of (or has generic user accounts for groups of people)? Am I the only one that would think that this is a little against the least-privilege principal for rights assignment? Or is there a valid reason to have this as a default? – Bart Silverstrim Mar 11 '10 at 12:35
How does this create a security risk? A computer as-per-se doesn't have any more rights in the domain when it's added. It's the logged-on user that has rights in the domain. No? – Vilx- Mar 11 '10 at 12:42
show 8 more comments
feedback
up vote 0 down vote

In order to add a computer to a Windows domain, your ID needs a few permissions:

Create/modify computer objects / Change password

and maybe one or two others.

Check your account and you'll probably find that, somewhere, these permissions (or more) are set.

link|improve this answer
1  
Nope, all you need is the Add workstations to domain right, which is given to Authenticated Users by default, for up to 10 PC's – Sam♦ Mar 11 '10 at 13:23
feedback
up vote -4 down vote

They were idiots. Whow. A "NORMAL USER" can not add ANY computer to a domain - domain addition requires access to an account with proper domain rights (domain admin priviledges).

Sure your account is not priviledged? ou probably are in the domain admins group without even knowing it ;) Check your group memberships in the active directory users and computers admin panel - you may be surprised about what you are ;)

link|improve this answer
-1, you're wrong. See my answer. – Graeme Donaldson Mar 11 '10 at 12:06
Basically every operation in Active Directory can be delegated to any kind of account on a very fine-grained level, regardless of group membership ^^ – Oskar Duveborn Mar 11 '10 at 12:08
Yeah, but normal users as default - that is pretty idiotic. As in: intall a domain, and everyone in the compand can add 10 coputers into the domain that need no approoval - pretty bad standard settings. – TomTom Mar 11 '10 at 12:16
It's probably there for some weird legacy reason. 1) Create new domain. 2) Customise the user right as required. Not very hard. – Graeme Donaldson Mar 11 '10 at 12:18
1  
Whenever I hear the attitude towards some little "papercut" (as the head of Canonical was calling it) as being simple to workaround so it's not an issue, I bristle a little. Then again I believe in some of the ideas expressed in books like "why software sucks" and "don't make me think"...just seems that if it's an issue that people have to work around or "fix" so it's no big deal, it shouldn't have been a big deal to not have to work around in the first place. But that's just me :-) I'm still trying to think of a legit reason to allow it as the default. Anyone? – Bart Silverstrim Mar 11 '10 at 14:17
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.