Before we adjourn a computer to a domain you should first create a computer object in the appropriate
owe you to join a computer turned 80 days domain.
You must meet three conditions.
First you must have appropriate permissions on the computer object that allow you to join a physical
computer with the same name to the domain.
Second you must be a member of the local administrators group on the computer.
This allows you to change the computer's domain or varied group membership.
And third you must not have exceeded the maximum number of computer accounts that you can add to the
domain by default.
Users can add a maximum of 10 computers to the domain.
This value is known as the machine account quarter and is controlled by the mass DNS machine quarter.
Well you you can modify the value by using the Active Directory Services interfaces editor or a DSA
added snap in.
It is recommended that you recreate the computer account in the correct owe you.
Prior to joining the computer to the domain.
This allows the computer to receive the appropriate group policies immediately.
If you do not recreate the computer account the computer account will be created in the computer's container.
Some words about delegates and permissions.
By default the enterprise Edmonds domain admins and administrators and account operators groups have
permissions to create computer objects in an in you owe you.
However as discussed earlier it is recommended that you tightly restrict membership in the first three
groups.
In addition it is recommended that you not at users who are members of the enterprise that most domain
admins or administrators groups to the account Operators Group.
Instead you should delegate the permission to create computer objects to appropriate administrators
or support personnel.
This permission which you assigned to the group to which you are delegated and delegating administration
allows group members to create computer objects in a specified Oh you for example you might allow your
desktop support team to create computer objects in the client's owe you and allow your file server administrators
to create computer objects in their file server so you to delegate permissions to create computer accounts.
You can use the delegation of control visa to choose a custom task to delegate when you delegate permissions
to manage computer records.
You might consider granting additional permissions beyond those required to create computer accounts.
For example you might decide to lower delegated administrator to manage the properties of existing computer
accounts to delete the computer account or to move the computer account.