Another Way to Provide the Missing Link

In the Reader to Reader article "The Missing Link in Windows' Group Hierarchy" (July 2006, InstantDoc ID 50022), Murat Yildirimoglu and Ugur Duman point out that the Windows' group hierarchy is missing a built-in group that can manage client computers but not domain controllers (DCs) and other crucial servers. To fill this void, they created a Technicians group, placed the Technicians group in the Domain Admins group, then removed the Domain Admins group from the Administrators group in Active Directory (AD) and from the Administrators group on crucial servers. That way, their technicians can add more than 10 workstations to the domain. This procedure seems like a lot of work.

At my company, we also created a group for our support technicians. However, to give this group's members the ability to add more than 10 computers to the domain, we gave them the Create Computer Objects permission in AD for the appropriate organizational units (OUs). We also removed the Add workstations to domain right for authenticated users in Group Policy so that the authenticated users can't add a workstation to the domain. You can access the Add workstations to domain option by navigating to Computer Configuration, Windows Settings, Local Policies, User Rights Assignments.

With this setup, our support technicians can add workstations to the domain without running into the default 10-workstation limit. We made this group a Restricted Group for additional security.
—Bill Brower