in our company we have some servers that are not centrally managed. I would like to clean up in the OU where these servers are located by disabling accounts that do not match certain criteria. While testing that I discovered that I can bypass the disabled state by unjoining and rejoining the domain.

Is there any way to prevent disabled computer accounts from joining the domain?

Thanks in advance.


I believe you can limit this by using group policy. If you have a group policy which doesn't allow users to join the domain, then you will basically reduce the risk of disabled computer leaving and re-joining the domain.

As mentioned in the article I'm adding here, the lowest permissions for joining a computer to the domain would be an "Authenticated user" https://social.technet.microsoft.com/Forums/windowsserver/en-US/27490147-f922-49d0-b105-4cc0a10c9324/what-is-the-minimum-privilege-to-join-client-pc-to-ad-domain?forum=winserverDS

This is probably the answer you're looking for: Is it possible to limit who on an AD domain can join computers to the domain?

Edit: Also this should be useful - restricting who can remove a computer from a domain: https://community.spiceworks.com/topic/180192-can-i-prevent-users-from-removing-pc-s-from-a-domain

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.