0

I've decided to review delegated permissions our branches have over Active Directory computer objects and reorganize things a bit.

One thing which stunned me is the fact that I need (according to lore all over the Internet) to grant Write All Properties to a security group in question over UO in which my computers are to rename the computer.

So I need to assign 1 permission to enable/disable computer account, 5 permissions to move computers between OUs and... to permit to write virtually every property of computer to simply rename a thing? WTF?

Is the Internet wrong? Are Microsoft nuts? What are you doing to restrict people simply to the renaming of computers?

There is no explanation on the web why such a mundane task as renaming computer should require such privileges which allows user to do pretty much anything with computer account beside renaming.

  • 1
    Possible duplicate of What access right is required to rename a computer – Swisstone Aug 16 at 12:46
  • Swisstone, you see, the the accepted answer on the question you pointed at leads to a Microsoft web site, where they say same thing which circulate around web - that I should give it write all permission. Which somehow makes no sense to me and which led me to asking that question in a first place.. – user2838376 Aug 16 at 13:32
0

Is the Internet wrong? Are Microsoft nuts? What are you doing to restrict people simply to the renaming of computers?

So that random hooligans/hackers/idiots/people who have no business doing this can't go around renaming computer accounts.

Imagine if an end user was able to rename computer accounts and they managed to rename the computer account for a Domain Controller, or an Exchange server, or any other computer account for a computer that's serving up a critical LOB application?

  • 3
    Methinks the OP was asking what we do to make it so that user accounts can ONLY rename computers and nothing more. I don't think the OP was questioning the logic of restricting that option. I think the OP is more upset that all accepted answers essentially grant full control of all properties on a computer when only the name is needed. – Semicolon Aug 16 at 14:26
  • Yes, correct, Semicolon! Thank you for clarification! – user2838376 Aug 16 at 15:21
0

Through trial and error I figured out that minimal permissions to rename computer object in domain are (in c:\Windows\System32\delegwiz.inf format):

ObjectTypes = computer

[templateNN.computer]

cn=WP

name=WP

distinguishedName=WP

sAMAccountName=WP

CONTROLRIGHT = "Account Restrictions","Validated write to DNS host name","Validated write to service principal name"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.