AD Properties: Adding Computer to Domain

[Guest]

Hi

I have a user, HelpDesk, that I have given rights to add computers to the domain via the "delegate control" wizard. I think when I look at the properties under "USER RIGHTS" in Hyena, I should see HelpDesk's name appear, but I don't. Any ideas on how to view the AD Right that HelpDesk has been given?

Linny

[kstanush]

Re: AD Properties: Adding Computer to Domain

This is something that we are still working and looking at in Hyena. Hyena can't view the delegated permissions right now. The User Rights is showing the older NT-style rights, which still exist on Windows 2000, but are now part of the policy.

We know that the delegated rights tend to become "set but where/lost" right now, and are working on a method to allow them to be managed and viewed.

[Guest]

Re: AD Properties: Adding Computer to Domain

Hi Kevin, Just checking in to see what this new version can do. I'm thinking that possibly now I could make some kind of report or list of people who have permission to join computers to the domain? A second question that is sortof related is: How can I get a listing of what user's have checks in the check box on the user account's security tab which states "allow inheritable permission from parent to propagate to this
object" ?

Thanks!
Linny

[cmccullough]

Re: AD Properties: Adding Computer to Domain

Unfortunately there's really no way to get either of these types of reports, and we're not sure what you could use to get them.

[Guest]

Re: AD Properties: Adding Computer to Domain

Thanks for checking. I know if it can be done, you guys will be the first to figure it out.
Linny

[cmccullough]

Re: AD Properties: Adding Computer to Domain

One thing that you can test is to right-click on the OU or Container that you've delegated this control to (such as Computers) and choose List Directory Security.

This will list security information in the right window. In testing, I delegated the ability to create and delete computer objects to a user account, and when I listed security this way I was able to see and entry for Special Access to the Computers object.

That may give you enough information to work with.

[Guest]

Re: AD Properties: Adding Computer to Domain

Thanks,
That is helpful!

Linny