RE: [ActiveDir] Problems Adding Computers to AD

Fri, 29 Oct 2004 11:45:49 -0700

Well, I gave it full control, and it still cannot add the computer to the domain. Even though all of the delegated rights are there, and the computer object is already created, do you also have to modify the group policy to allow your 'computer add' groups the right to add computers to the domain? We don't want them adding computer objects anywhere other than where they have been granted delegated rights, though. And, we don't want them adding to the default Computer container. Do we have to do that?

From: "joe" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
To: <[EMAIL PROTECTED]>
Subject: RE: [ActiveDir] Problems Adding Computers to AD
Date: Thu, 28 Oct 2004 16:30:12 -0400

Yeah the issue I saw was specific to disjoint namespaces and the new
functionality in K3 AD that was verifying the domain names of the hosts.

I would be curious though, just for test, not for final solution if you went
back to the created object and gave the group you mention FC of the computer
object and see if it allows the join ok.

  joe

-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jacob Walker
Sent: Thursday, October 28, 2004 3:54 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] Problems Adding Computers to AD

Actually, we don't have a disjointed namespace. They are specifying a group
to which their userid is a member. Then, they go to the PC to change it's
domain.

>From: "joe" <[EMAIL PROTECTED]>
>Reply-To: [EMAIL PROTECTED]
>To: <[EMAIL PROTECTED]>
>Subject: RE: [ActiveDir] Problems Adding Computers to AD
>Date: Thu, 28 Oct 2004 15:15:07 -0400
>
>Do you have a disjoint namespace?
>
>When they create the objects, what do they specify for who can join?
>
>
>
>-----Original Message-----
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of Jacob Walker
>Sent: Thursday, October 28, 2004 1:18 PM
>To: [EMAIL PROTECTED]
>Subject: RE: [ActiveDir] Problems Adding Computers to AD
>
>Thank you, Joe.  We are implementing Windows Server 2003 AD.  Here are
>the permissions we have assigned.  Any clue as to what critical
>permission could be missing?
>
>This object and all child objects:
>Create Computer Objects
>
>Computer Objects:
>List Contents
>Read All Properties
>Write All Properties
>Read Permissions
>
>-----Original Message-----
>From: joe [mailto:[EMAIL PROTECTED]
>Sent: Thursday, October 28, 2004 11:50 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [ActiveDir] Problems Adding Computers to AD
>
>I have seen that with Windows Server 2003 AD if there aren't enough
>permissions delegated to the person/group actually doing the join in a
>disjointed namespace environment.
>
>   joe
>
>-----Original Message-----
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of Jacob Walker
>Sent: Thursday, October 28, 2004 11:37 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [ActiveDir] Problems Adding Computers to AD
>
>Thanks, but nothing there really seems to help.  It's strange.  When we
>look at the computer account in the domain, it also ends up disabling
>it.
>
>-----Original Message-----
>From: Jacob Walker [mailto:[EMAIL PROTECTED]
>Sent: Tuesday, October 26, 2004 4:34 PM
>To: [EMAIL PROTECTED]
>Subject: [ActiveDir] Problems Adding Computers to AD
>
>We've delegate the permission to add computer accounts to our AD
>environment
>
>to some admins.  They can go into ADUC and add the computer account
>without problem.  However, when they go to the PC to change it's domain
>membership, on some PC's they get an error about not enough storage
>space.  But, some PC's work fine.  We cannot determine why this is
happening.  Any ideas?
>
>_________________________________________________________________
>Check out Election 2004 for up-to-date election news, plus voter tools
>and more! http://special.msn.com/msn/election2004.armx
>
>List info   : http://www.activedir.org/mail_list.htm
>List FAQ    : http://www.activedir.org/list_faq.htm
>List archive:
>http://www.mail-archive.com/activedir%40mail.activedir.org/
>
>List info   : http://www.activedir.org/mail_list.htm
>List FAQ    : http://www.activedir.org/list_faq.htm
>List archive:
>http://www.mail-archive.com/activedir%40mail.activedir.org/

_________________________________________________________________
Check out Election 2004 for up-to-date election news, plus voter tools and
more! http://special.msn.com/msn/election2004.armx

List info   : http://www.activedir.org/mail_list.htm
List FAQ    : http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

List info   : http://www.activedir.org/mail_list.htm
List FAQ    : http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

_________________________________________________________________
Check out Election 2004 for up-to-date election news, plus voter tools and more! http://special.msn.com/msn/election2004.armx

List info   : http://www.activedir.org/mail_list.htm
List FAQ    : http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

Reply via email to