Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm granting least privileges needed for an account, that he could rename the computer machine name for each client. (All Windows 7 PCs)

These clients have already joined the domain, now what kind of privileges should I grant to that account? Not the domain admins group, of course.

Also I tried to grant full control of Computers objects to that account, but when I navigated to the Computer Properties tab, on Advanced System Settings tab, I clicked the button and it still asks for password of a Domain Admin account.

What's the right way to do so?

share|improve this question

The user needs to be a local admin on the machine whose name is being changed and have "Create Computer Object" and "Delete Computer Object" on the OU that the object is in at a minimum.

Delegating full control of computer objects is more than enough. My bet is that his account wasn't a local admin on the machine whose name was being changed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.