Domain user permissions to join the domain

Ordinary users to join the domain rights issues. I now want to use an ordinary domain user, so that he can be with or without permission several times to join the domain is not limited to 10 times the number of domain-joined, is there any good way to achieve it? And then disable all other domain users permissions to join the domain, I ask how to achieve better.

Answer: Based on your description, you want to know how to make a user has permission to 10 times larger than the default domain-joined computers. We can accomplish this by:

1, open the Group Policy Editor, double-click the Default Domain Controllers Policy

2. Expand find the following policy:
Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment | add workstations to the domain

3. Double-click the policy, which will be authenticated users to remove, and then add into the user's account.

These above operations, is used to set the default permission right to join a computer 10 domain. Then, we need to modify the default 10 times this limitation: you see articles from Active Directory SEO http://gnaw0725.blog.51cto.com/156601/d-1

1. Run Adsiedit.msc as an administrator of the domain.

2. Expand Domain NC node. This node contains objects that begin with "DC =", reflects the correct domain name. Right-click the object, and then click Properties.

3. In the properties box you want to view, click Both.

4. In the Select a property to view box, click ms-DS-MachineAccountQuota.

5. In the Edit Attribute box, type a number. This number represents the number of users that may be maintained while the desired station.
6. Click Settings, and then click OK.

If you need to set up a separate user with this permission, you can use the following steps to grant this particular user to create computer objects permissions:

1. From Active Directory Users and Computers snap-in, click Advanced Features on the View menu, click Properties so that when you open the Security tab.

2. Right-click the Computers container, and then click Properties.

3. On the Security tab, click Advanced.
4. On the Permissions tab, click Authenticated Users, and then click View / Edit.

Note: If the Authenticated Users group is not listed, click Add and add it to the list of permission entries. You see articles from Active Directory SEO http://gnaw0725.blog.51cto.com/156601/d-1

5. Make sure the display object and all child objects option in the application to the box.
6. Permissions box, click to select the Create objects near the computer and remove computer objects ACE Allow check box, and then click OK.