Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are trying to prevent users from willy-nilly joining VMs and outside machines to our domain. The default is any user can join up to 10 machines. Is there a way to limit this to only Account Operators, Domain Admins, and Enterprise Admins?

share|improve this question

migrated from Jul 15 '11 at 15:45

This question came from our site for computer enthusiasts and power users.

May as well leave it here since it has been answered (and I believe, correctly). – KCotreau Jul 15 '11 at 15:19
It's best its put on the proper site though for people looking in the future. – Joe Taylor Jul 15 '11 at 15:48
up vote 11 down vote accepted

Go into your Domain Security Policy>Local Policy>User Rights Assignment and change the "Add workstations to domain" to just the groups you want.

enter image description here

share|improve this answer

I believe what you're looking for is referenced in these two MSKB articles:

The first article gives the details on where to go in Adsiedit.msc to change the default value (Domain NC, pick the right item, Properties, view ms-DS-MachineAccountQuota, edit attribute to change the value).

I've also seen a mention that there's a Group Policy under Default Domain Controllers Policy\User Rights Assignment but I'm not at a good spot to go digging for it to verify.

share|improve this answer

Have you looked at this:

There is a group policy that can change who has the right to add machines to the domain. I'm not in front of a server at the moment but if I remember correctly this can be changed easily.

KCotreau's answer shows the group policy changes I mention in detail.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.