Add Computer to Domain Delegation

in process of separating administrator rolls within domain, , cannot find definitive source required permissions need granted adding workstations domain. found following within forums, cannot find technet article supports these correction permissions. want delegate needed no additional rights:

set ou=ou=someou,dc=contoso,dc=com
set sp=contoso\addtodomain

:: grant permissions add , delete computer objects
dsacls %ou% /i:t /g %sp%:cc;computer;
dsacls %ou% /i:t /g %sp%:dc;computer;

:: grant permissions join computers domain
dsacls %ou% /i:s /g %sp%:calcgrsddtrc;;computer
dsacls %ou% /i:s /g %sp%:wp;description;computer
dsacls %ou% /i:s /g %sp%:wp;samaccountname;computer
dsacls %ou% /i:s /g %sp%:wp;displayname;computer
dsacls %ou% /i:s /g %sp%:wp;useraccountcontrol;computer
dsacls %ou% /i:s /g %sp%:ws;"validated write service principal name";computer
dsacls %ou% /i:s /g %sp%:ws;"validated write dns host name";computer

is there source documents requirements this? not asking rights (i know there), need know delegation accurate.

hi,

thanks posting.

did check similar thread?

delegate control - add/remove computers

http://social.technet.microsoft.com/forums/en-us/68e3c67c-e79a-47c3-8090-0304fa71f5f2/delegate-control-addremove-computers?forum=winservermanagement

meanwhile, permissions required join computer domain are:

reset password
validated write dns host name
validated write service principal name
write account restrictions

http://support.microsoft.com/kb/932455/en-us

please feel free let know if have updates.

regards.

if have feedback on our support, please click here

 

---

vivian wang

Windows Server  >  Directory Services