How to restrict "Add workstations to Domain" to a specific group in AD

-

i work in process control network responsible oil, gas , energy companies on world. on past few years pcn world has been introducing domain infrastructure industry.

there 1 company produces full ad security package products.

however ad package secures pcn part of domain , not windows side of domain or 3<sup>rd</sup> party devices.  as part of project am tasked with, have allow 3<sup>rd</sup> party companies administer users, computers , servers.

unfortunately these 3<sup>rd</sup> party devices have no ad plan still work on workgroup technology , security.  

so want limit these 3<sup>rd</sup> party devices as possible not use gpo’s or other domain securities. role in this, have introduce these devices domain , restrict these 3<sup>rd</sup> party engineers as possible. have been able of restrictions.

 

i stuck on part though.

 

situation:

all users except domain admins have been denied add workstation domain.

extra ou 3<sup>rd</sup> party company , engineers group has been made these devices , users.

 

as client has stipulated 3<sup>rd</sup> party company must administrate own devices , not head pcn iit team. following 3<sup>rd</sup> party requirements required.

 

·         joining device domain (currently moore devices)

 

·         installing av software , agent (as part of maintenance actions) (local admin account)(non domian)

 

·         installing software (local admin account)(non domian)

 

·         clearing of event logs (preventative maintenance) (local admin account)(non domian)

 

·         device driver management (local admin account)(non domian)

 

·         local user support (local admin account)(non domian)

 

so want delegate administration these 3<sup>rd</sup> party companies cant find anywhere can this.

 

i see need setup following.

 

separate ou :

3<sup>rd</sup> party administrators

computers

servers

groups

 

the administrative rights must allow:

add remove of own devices in domain:

they must not allowed remove other devices

devices must install in 1 computer / server ou , not require drag , drop ou

 

so asking guide me correct procedures able this.

 

thanks

 

 

 

refer http://social.technet.microsoft.com/forums/en-us/winserverds/thread/734a187b-6b4a-48e6-a02d-100bf8809145

hth
marcin



Windows Server  >  Directory Services



Comments

Post a Comment

Popular posts from this blog

directory stack

-
witchcraft>> $algo -eq $null true witchcraft>> cd $algo.key # directory stack: --- ---------------- 0 c:\users\voodoomsr\valhala 1 c:\users\voodoomsr\valhala\witchcraft\expectopatronum 2 c:\users\voodoomsr\valhala\witchcraft\expectopatronum\comunidad 3 c:\users\voodoomsr\valhala\witchcraft\expectopatronum\comunidad\stack 4 c:\users\voodoomsr\valhala -> 5 c:\users\voodoomsr\valhala\witchcraft witchcraft>> hi all, found extrange thing don't understand. if execute set-location inexistence object list of directories. what that? i see it, can't reproduce it.   when enter you've got posted there, set-location error, because value of argument "path" null.     [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " " mistake!. after that, check alias cd , asigned function set-locationex. fu...
Read more

PowerShell List

-
hello everyone, i'm trying list vms in scvmm i'm using get-vm -vmmserver vmm01.mydomain.tld | export-csv c:\listvm.csv but returns info each vm, return properties want, way (that know) properties using: get-vm -vmmserver vmm01.mydomain.tld | format-list -property name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status but if add get-vm -vmmserver vmm01.mydomain.tld | format-list -property name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status | export-csv c:\listvm.csv now have mess... any way working nice , clean? thank you ok, found solution get-vm -vmmserver vmm01.mydomain.tld | select name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status | export-csv c:\listvm.csv thank you. Windows Server  >  ...
Read more

Reboot a PC list

-
i thought simple command, need assistance please. trying reboot/restart multiple pc's text file using ps command... ps c:\> restart-computer ( get-content c:\wsus\task\train1wol.txt ) hoping pull names of pc's listed text file, receive several error messages. can point me in correct direction or need more info run on windows 2008r2 running latest version of powershell? in advance. you don't have ps c:\> in script, you? don't retire technet! - (don't give yet - 12,830+ strong , growing) Windows Server  >  Windows PowerShell
Read more