Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the process of putting together a puppet recipe which will install Likewise Open on Linux machines and join them to a specific OU in our AD structure.

Since the only practical way to do this involves storing the credentials of an AD user in plain text in the puppet manifest, I want to create a dedicated AD user which only has rights to join computers to a specific OU.

I recall doing something like this years ago but I'm a little rusty on the details.

I have already created an AD user and made sure it is in the Domain Guests group rather than Domain Users, but I'm not sure of the exact details I should use when I delegate rights to this user on the OU.

Can someone tell me the specific options and rights I need to use in the Delegate Control wizard?

share|improve this question
up vote 5 down vote accepted

I would recommend creating a group named something like Account Management Computers, to which you would add this account as a member. This way you can always modify the group members to update delegation without changing the ACL.

  • Start the Delegate Control wizard on the OU/CN you want to modify.
  • Select the group/user. Choose "Create a custom task to delegate".
  • Select "Only the following objects in the folder".
  • Tick: "Computer objects" and "Create selected objects in this folder".
  • On the next page, tick "Create all child objects".
share|improve this answer
Cool, thanks. :-) – ThatGraemeGuy Dec 9 '10 at 13:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.