I'm granting least privileges needed for an account, that he could rename the computer machine name for each client. (All Windows 7 PCs)

These clients have already joined the domain, now what kind of privileges should I grant to that account? Not the domain admins group, of course.

Also I tried to grant full control of Computers objects to that account, but when I navigated to the Computer Properties tab, on Advanced System Settings tab, I clicked the button and it still asks for password of a Domain Admin account.

What's the right way to do so?


The user needs to be a local admin on the machine whose name is being changed and have "Create Computer Object" and "Delete Computer Object" on the OU that the object is in at a minimum.

Delegating full control of computer objects is more than enough. My bet is that his account wasn't a local admin on the machine whose name was being changed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.