Microsoft AD - Creating a user account for domain joins/binds

Issue details

Microsoft AD - Creating a user account for domain joins/binds

When joining lots of machines to a domain, it's normally a good idea to setup a specific account that can do this with the lowest level of permissions possible. Any domain user can be used to join a domain, however by default they are limited to performing the join operation 10 times.

Solution

To create a special domain user, which isn't limited to this, follow the steps below:

1. Login to your domain controller via RDP or another method.

2. Open the 'Active Directory Users and Computers' tool.

3. Select the organisational unit (OU) that you would like to create the user in, and press the create user button, as shown below:

    

   

4. Enter the new details for the user and click 'Next'.

5. Enter a password and ensure that 'User must change password at next logon' is unticked. Ensure 'Password never expires' is ticked (Optional) .

6. Click 'Next', then click 'Finish'.

7. Right click on the OU or container where computer objects will be created and select 'Delegate control'.

    

8. Click 'Next' when the wizard opens, then click 'Add' and enter the username for the user you just created.
   FOR 2012, SKIP TO STEP 12

9. Click 'Next'.

10. Ensure 'Join a computer to the domain' is ticked in the 'Delegate the following common tasks' list, as shown below.

    

    
    

11. Click 'Next', then click 'Finish'
    
    
    2012 ONLY

12. Select Create a custom task to delegate
    

    

    
    

13. Choose Only the following objects in the folder and check the box Computer Objects. Check the box Create selected objects in this folder. Click Next.
    

    

    
    

14. Permissions – Select General, select Create All Child Objects. Click Next.

    
    

    

    
    

15. Click FInish