Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to block computers from joining a domain on the domain controller - ie only permit domain access to domain computers?

The requirement is that even the Domain Admins would be unable to join a computer to the domain without adding it to the DC first?

Setup is SBS2003 R2 Premium with XP/W7 clients.


share|improve this question
up vote 1 down vote accepted

Your comment makes things seem more clear.

802.1X or IPSEC, deployed using certificates on each client computer to permit client device authentication, is going to give you the secure environment that you want. Nothing can be done to easily prevent unauthorized devices from being attached to the network medium (with spoofed IP or MAC addresses, as necessary) if you're not actually authenticating the client devices.

If the users can physically manipulate the client devicess (i.e. attempt to pry the certificate out of the device) then even device authentication is no good.

Assuming, though, that you can store the device certificate in a reasonably tamper-proof location that cannot be practically accessed you can create a very secure situation, with respect to unauthorized devices being attached to the network medium and used to access servers, using either 802.1X or IPSEC.

share|improve this answer
Thanks - the reason behind it is that we are looking for total control over the physical computers that can interface with the domain - including accessing files that you may own through that "unpermitted" device. Sorry I can't think of a better way to explain it. – Chris Dec 2 '09 at 16:58
@Chris: I dropped on an edit. – Evan Anderson Dec 2 '09 at 17:40
Thanks Evan - this looks like it'll do what we need. – Chris Dec 4 '09 at 11:33

Basically "what Evan said", emphasising that in normal operation messing with default behaviours is a baaaaaad idea.

If you really want, you could cook up something using the info in this KB article (and some imagination on your part).

An alternative is to do something with the "Add workstations to domain" GPO setting (documentation here).

share|improve this answer

mh, Evan is correct however "un-normal" such a setup seems to you.

google around for microsoft docs on how to setup ipsec domain isolation, such as this one

i used many of these docs to get the hang of how to set this up on my home lan. i use negotiate mode for all ipsec policies. this makes all my domain traffic secure but allows outside clients to connect if needed. i use kerberos for authentication instead of a pki server since its easier to manage, but i'm workin my way up to the pki server setup.

your other options are products from 3rd party security vendors like symantec,

and there are others out there that allow for the same scenerio. heck, you could even use a firewall on every client/server with policies to only communicate with ip's in the allow list, and keep a list of all mac/ip's using a dhcp registration system. windows 2008 r2 now has dhcp mac registration options i read a bit about, that could be scripted to do some funky stuff later on down the road.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.