Windows Tip: Preventing removal from a domain

January 22, 2007 —

Send your Windows question to Mitch today! | See other Windows tips

By default, any authenticated users on an Active Directory-based network can add a Windows XP workstation to a domain. In fact, they can create up to ten computer accounts in the domain if they want to. As an administrator, you can use Group Policy to manage who in your organization has the right to join workstations to the domain by configuring the Add Workstations To Domain policy setting, which is found under Computer Configuration/Windows Settings/Security Settings/Local Policies/User Rights Assignments. To configure this setting, open the Default Domain Controllers Policy in Group Policy Object Editor, double-click on the policy setting, remove Authenticated Users and add only those specific users or groups whom you want to be able to perform this action.

Doing this lets you prevent ordinary users from joining machines to the domain. But how can you prevent users from removing a computer from a domain? Unfortunately, the Add Workstations To Domain policy setting controls only who can add machines to the domain, not remove them. And there's no Group Policy setting for specifying who has the right to remove machines from the domain. What can you do?

The answer is simply to not make ordinary users local administrators on their computers. This is because local administrators always have the right to remove their computers from the domain, which causes their computers to become unmanaged machines that are beyond the scope of your security policies. Of course, having users running as non-admins can be a pain for them at times (and can increase Support Desk costs too) but it's essential if you want to ensure the security of your corporate desktops.

ITworld.com