Windows Server Team

Hi There, 

I have a problem where I want to allow a more competant user to have local Administrator rights on computers in a specific OU, and to be able to join computers to the domain.

I do not want him to be in the Domain Admins group, I do not want him to be able to access any servers.

Is there an easy way to do this?  His responsibilitys will be to install new desktops and join them to the domain.

Obviously I could add him to the local administrators group on all of the PCs but to do this I would involve alot of hassle.

Any help much appreciated.

Thanks.

I'm not sure about local administrator rights, but it's definately a 30 second job to grant a user permission to add machines to the domain. On the DC, in Administrative Tools, open Domain Security Policy. The section you need is Local Policies > User Rights Assignment and the specific permission to grant is 'Add workstations to domain'. Its probably best to create a new security group, put the user in that group and then grant the permission to that group rather than granting permissions to individual users (easier to manage if you decide to grant this permission to more users in the future, for example). The user can now add or remove machines from the domain without requiring a domain admin account.

 Not sure about granting local admin permissions, I think you may have to configure that on a per-machine basis. I'll have a browse though and see if I can find anything. Out of interest, what is this user going to be doing that would require local admin permissions?

I should add, that if the 'Add workstations to domain' permission is not defined, any authenticated user can add machines to the domain. I believe they are limited to creating up to 10 computer accounts. If you click on the 'Explain this setting' tab and have a read you'll see a bit more of how it works.