We're deploying Active Directory, and we're using PowerShell scripts for most of it: creating the forest, creating AD elements (users, groups, sites, subnets), etc. We'd like to make some users able to join machines to the domain, but I haven't found a way to do it with PowerShell. It seems there are no cmdlets for that. Is it so? Is it impossible to add this kind of permissions using only PowerShell?

Thanks in advance.

  • 2
    I believe Authenticated Users can add up to 10 computers to an AD domain. Otherwise, you could create a new AD group for joining computers to the domain, add your users you want to add computers to the group, add the group to the Computers object, and set Create Computer Objects and Delete Computer Objects entries to Allow. If that works for you, then the next step is to create the PowerShell script to do that. – Tim Jun 29 '15 at 16:07
  • 2
    Creating a group really is the best way. You really should avoid adding permissions directly to an individual account whenever you can. – Zoredache Jun 29 '15 at 16:22
  • @Tim, the "create the PowerShell script" bit is the one I'm having problems with :-) I haven't found any cmdlet that lets you add those permissions to an account. Does it exist? – rsuarez Jun 30 '15 at 8:17

If you want a purely powershell method, you may use info from this technet blog post, or take a look at the Quest powershell cmdlets. http://blogs.technet.com/b/joec/archive/2013/04/25/active-directory-delegation-via-powershell.aspx

In my company we have several groups that need to create unlimited computer accounts. I continue to use the DSACLS.EXE tool, because I have past experience with it, and while it is cryptic I can accomplish in a few lines what take many many lines of pure powershell with either of the methods mentioned above. DSACLS has a long and very thorough help page. I've pared it down for brevity in this post to only address the perm to create computer accounts. With some research, you should also be able to find the object names and permission levels to create the other things you mention. Remember that Users & Groups would be covered by membership in "Account Operators" and you may want to restrict Site & Subnet creation to members of "Domain Admins"

Grant a group the right to create computer accounts at a given OU path. Replace ThisDom & ThisGroup to fit your environment.

dsacls "OU=coyote,DC=acme,DC=com" /I:T /G 'ThisDom\ThisGroup:CCDC;computer'
dsacls "OU=coyote,DC=acme,DC=com" /I:S /G 'ThisDom\ThisGroup:WO;;computer'
dsacls "OU=coyote,DC=acme,DC=com" /I:S /G 'ThisDom\ThisGroup:WP;userAccountControl;computer'

Usage (edited)

C:\Windows\System32>dsacls /?
Displays or modifies permissions (ACLS) of an Active Directory Domain Services (AD DS) Object

DSACLS object [/I:TSP] [/N] [/P:YN] [/G <group/user>:<perms> [...]]
              [/R <group/user> [...]] [/D <group/user>:<perms> [...]]
              [/S] [/T] [/A] [/resetDefaultDACL] [/resetDefaultSACL]
              [/takeOwnership] [/user:<userName>] [/passwd:<passwd> | *]
<... skipped lines...>
   /I               Inheritance flags:
                        T: This object and sub objects
                        S: Sub objects only
                        P: Propagate inheritable permissions one level only.
<... skipped lines...>
   /G  <group/user>:<perms>
                    Grant specified group (or user) specified permissions.
                    See below for format of <group/user> and <perms>
<... skipped lines...>
            CC      Create child object
            DC      Delete a child object
            WO      Change owner information
            WP      Write property
| improve this answer | |
  • Thanks, I'm marking this as the right answer because the link you provided is the closest to a pure PowerShell solution. I had stumbled upon it too, but thought that maybe there was something easier. Thanks again! – rsuarez Jul 9 '15 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.