I normally use Account1 to manually create computer objects in Active Directory and then join the corresponding Windows machines to the domain with that same account. I now need to join several other machines, but I do not want Account1 to interact with them at all, including through background or internal operations.
What is the current supported way to have one account create or prestage a computer object while a different account performs the domain join? Is there a permission or delegation setting that handles this cleanly?
One possible approach would be to create a temporary account, grant it the necessary permissions on the target OU, use it to create the computer objects and join the machines, then remove the account and its local profile afterward. However, I would prefer a proper least-privilege method if one exists. Some of this environment was intentionally designed around manual procedures rather than automation, so I am looking for a solution that respects that separation.
4 Answers
The account that creates the computer object does not have to be the account that joins the machine. Prestage the computer object in the correct OU, then delegate the required permissions on that specific object or OU to the account that will perform the join. The join account can then bind the machine without using Account1.
There is no special new workaround required here. Active Directory has long supported separating object creation from the join operation through permissions and delegation. Before creating a temporary administrator account, check the permissions on the target OU and grant a dedicated, least-privilege provisioning account only the rights it needs. That gives you better auditing and avoids having to clean up a powerful temporary account and local profile afterward.
You generally have several supported choices: delegate rights to join prestaged objects, delegate permission to join an unrestricted number of devices, or use offline domain join. Offline domain join is especially useful when the device should not contact the domain during the provisioning step; a domain administrator or provisioning system creates the join blob, and the device applies it locally before contacting a domain controller later.
You can set this up directly in the computer-account creation wizard by specifying who is allowed to join the computer to the domain. That is useful when the object is created by one administrator but the actual machines are joined by another account, including non-Windows systems in some environments.
A normal domain account may already be allowed to join a limited number of computers by default, but relying on that default is usually less controlled. Explicit delegation on the target OU or computer objects makes the intended separation much clearer.