Restrict Desktop support from Adding Servers to the Domain

We have a w2k3 domain. Our desktop was given the rights to add computers to
the domain. We have discovered that they are on occasion somehow adding
servers. How can we restrict them to only be able to add desktops and not
servers?

thanks in advance

Standardize your server build process and ensure that your desktop group is
not included in the local Administrators group...

hth
Marcin

"mikee" <mikee@discussions.microsoft.com> wrote in message
news:D964EEC1-D1EA-4D55-B6AC-463333384091@microsoft.com...
> We have a w2k3 domain. Our desktop was given the rights to add computers
> to
> the domain. We have discovered that they are on occasion somehow adding
> servers. How can we restrict them to only be able to add desktops and not
> servers?
>
> thanks in advance

Hello mikee,

You have to make sure that they are not able to logon to the servers as local
administrator. ANd the easiest way is to install your servers yourself.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> We have a w2k3 domain. Our desktop was given the rights to add
> computers to the domain. We have discovered that they are on occasion
> somehow adding servers. How can we restrict them to only be able to
> add desktops and not servers?
>
> thanks in advance
>

We are finding that users in other depts are building servers and desktop
support personel is adding the servers to the domain. How can take away the
rights of desktop support to add a server to the domain. They will still need
to be able to add a pc.

"Meinolf Weber [MVP-DS]" wrote:

> Hello mikee,
>
> You have to make sure that they are not able to logon to the servers as local
> administrator. ANd the easiest way is to install your servers yourself.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
> > We have a w2k3 domain. Our desktop was given the rights to add
> > computers to the domain. We have discovered that they are on occasion
> > somehow adding servers. How can we restrict them to only be able to
> > add desktops and not servers?
> >
> > thanks in advance
> >
>
>
>

Hello mikee,

You can not set permissions only for server or workstation OS.

This is not really a permission problem, this belongs to company policies,
who is allowed to do what task.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> We are finding that users in other depts are building servers and
> desktop support personel is adding the servers to the domain. How can
> take away the rights of desktop support to add a server to the domain.
> They will still need to be able to add a pc.
>
> "Meinolf Weber [MVP-DS]" wrote:
>
>> Hello mikee,
>>
>> You have to make sure that they are not able to logon to the servers
>> as local administrator. ANd the easiest way is to install your
>> servers yourself.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> We have a w2k3 domain. Our desktop was given the rights to add
>>> computers to the domain. We have discovered that they are on
>>> occasion somehow adding servers. How can we restrict them to only be
>>> able to add desktops and not servers?
>>>
>>> thanks in advance
>>>