Increase the number of workstations a user can join to a domain

Increase the number of workstations a user can join to a domain

Change the number of machines a user can join to a domain by editing the ms-DS-MachineAccountQuota attribute with ADSI Edit.

 How to increase the number of machines a user could join to a domain.

By default, Active Directory allows members of the Authenticated Users group to join up to 10 computer accounts to the default Computers container. If a user tries to add more than 10 workstations, they are likely to receive one of the following error messages:

“The machine account for this computer either does not exist or is unavailable.”

“Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased.”

“The following error occurred attempting to join the domain “domain.com”.

 Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased.”

According to MSKB articles 251335 and 314462, there are three ways to resolve this problem:

Pre-Create the User’s Computer Account

Grant the “Create Computer Objects” and “Delete Computer Objects” Access Control Entries (ACEs) to the User

 Override the Default Limit of the Number of Computers an Authenticated User Can Join to a Domain

While the first two solutions will solve the problem, it’s the third one that we’re most interested in, as it actually changes the default limit on the number of workstations a user can join to the domain.

Using ADSI Edit to set the ms-DS-MachineAccountQuota attribute

The number of workstations a user can join to a domain is configured by the ms-DS-MachineAccountQuota attribute. Using the Active Directory Service Interfaces Editors (ADSI Edit) you can manage Active Directory objects and attributes.

To run ADSI Edit on Windows Server 2003 or Windows XP machines, you’ll need to install Windows Server 2003 Support Tools, which you’ll find on the Windows Server 2003 CD or the Microsoft Download Center. If you’re running Windows Server 2008, ADSI Edit is installed as part of the Active Directory Domain Services (AD DS) role, which makes the server a domain controller. You can also install the Remote Server Administration Tool (RSAT) on server that aren’t domain controllers.  On machines running Windows Vista SP1 or Windows 7, you must install RSAT to use ADSI Edit.

Once you have ADSI Edit installed, you can change the ms-DS-MachineAccountQuota attribute with the following steps:

Click Start | Run | and enter adsiedit.msc.

Expand the Domain node and locate the object that begins with “DC=” and contains the domain name of the domain your interested in.

 Right on the “DC=” object and click Properties.

 Locate the ms-DS-MachineAccountQuota attribute on the Attribute Editor tab and click Edit.

 On the Integer Attribute Editor dialog, enter the number of workstations you want users to be able to add. You can enter 0 to prevent users from joining any workstations to the domain or clear the value to remove the limit.

 Once you’ve entered the appropriate value, click OK to close the Integer Attribute Editor dialog box and OK again to close the Properties box.

 Close ADSI Edit.

Using the command line or VBScript to set the ms-DS-MachineAccountQuota attribute

While most Microsoft documentation on editing the ms-DS-MachineAccountQuota attribute relies on the ADSI edit method outlined above, you could also use the command line or VBScript. For examples of these methods, check out the article “Recipe 8.11. Changing the Maximum Number of Computers a User Can Join to the Domain,” from the CodeIdol.com.

Courtesy:-http://www.techrepublic.com 

Installing Active Directory(Domain) in Windows Server 2008

Installing Active Directory Domain Services (AD-DS)

In Windows Server 2008, unlike previous server operating Systems, there is an additional step that needs to be taken before running DCPROMO to promote the server to Domain Controller and installing Active Directory on it. This step is the installation of Active Directory Domain Services (AD-DS) role on the server. In fact, the AD-DS role is what enables the server to act as a Domain Controller, but you will still need to run DCPROMO the regular way.

AD-DS can be installed in one of 3 methods:

Method 1 – Server Manager/Initial Configuration Tasks

Roles can and should be added from Server Manager (but they can also be initiated from the Initial Configuration Tasks wizard that auto-opens the first time you log on to the server).

1. Open Server Manager by clicking the icon in the Quick Launch toolbar, or from the Administrative Tools folder.
2. Wait till it finishes loading, then click on Roles > Add Roles link.

3. In the Before you begin window, click Next.

4. In the Select Server Roles window, click to select Active Directory Domain Services, and then click Next.

5. In the Active Directory Domain Services window read the provided information if you want to, and then click Next.

6. In the Confirm Installation Selections, read the provided information if you want to, and then click Next.

7. Wait till the process completes.

8. When it ends, click Close.

9. Going back to Server Manager, click on the Active Directory Domain Services link, and note that there's no information linked to it, because the DCPROMO command has not been run yet.

10. Now you can click on the DCPROMO link, or read on.
    1. To run DCPROMO, enter the command in the Run command, or click on the DCPROMO link from Server Manager > Roles > Active Directory Domain Services.
    
    2. Depending upon the question if AD-DS was previously installed or not, the Active Directory Domain Services Installation Wizard will appear immediately or after a short while. Click Next.
    
    1. In the Operating System Compatibility window, read the provided information and click Next.
    
    2. In the Choosing Deployment Configuration window, click on "Create a new domain in a new forest" and click Next.
    
    3. Enter an appropriate name for the new domain. Make sure you pick the right domain name, as renaming domains is a task you will not wish to perform on a daily basis. Click Next.
    
    Note: Do NOT use single label domain names such as "mydomain" or similar. You MUST pick a full domain name such as "mydomain.local" or "mydomain.com" and so on.
    The wizard will perform checks to see if the domain name is not already in use on the local network.
    
    4. Pick the right forest function level. Windows 2000 mode is the default, and it allows the addition of Windows 2000, Windows Server 2003 and Windows Server 2008 Domain Controllers to the forest you're creating. Read my "Understanding Windows Server 2008 Active Directory Domain and Forest Functional Levels" article for more information on that.
    
    5. Pick the right domain function level. Windows 2000 Native mode is the default, and it allows the addition of Windows 2000, Windows Server 2003 and Windows Server 2008 Domain Controllers to the domain you're creating.
    
    Note: If you select "Windows Server 2008" for the forest function level, you will Not be prompted to pick a domain function level. Read more about domain and forest function levels on my "Understanding Windows Server 2008 Active Directory Domain and Forest Functional Levels" article.
    6. The wizard will perform checks to see if DNS is properly configured on the local network. In this case, no DNS server has been configured, therefore, the wizard will offer to automatically install DNS on this server.
    
    Note: The first DCs must also be a Global Catalog. Also, the first DCs in a forest cannot be a Read Only Domain controller.
    7. It's most likely that you'll get a warning telling you that the server has one or more dynamic IP Addresses. Running IPCONFIG /all will show that this is not the case, because as you can clearly see, I have given the server a static IP Address. So, where did this come from? The answer is IPv6. I did not manually configure the IPv6 Address, hence the warning. In a network where IPv6 is not used, you can safely ignore this warning.
    
    8. You'll probably get a warning about DNS delegation. Since no DNS has been configured yet, you can ignore the message and click Yes.
    
    9. Next, change the paths for the AD database, log files and SYSVOL folder. For large deployments, carefully plan your DC configuration to get the maximum performance. When satisfied, click Next.
    
    10. Enter the password for the Active Directory Recovery Mode. This password must be kept confidential, and because it stays constant while regular domain user passwords expire (based upon the password policy configured for the domain, the default is 42 days), it does not. This password should be complex and at least 7 characters long. I strongly suggest that you do NOT use the regular administrator's password, and that you write it down and securely store it. Click Next.
    
    11. In the Summary window review your selections, and if required, save them to an unattend answer file. When satisfied, click Next.
    
    12. The wizard will begin creating the Active Directory domain, and when finished, you will need to press Finish and reboot your computer.
    
    Ok Click to restart. There you installed the new active directory
    source:www.petri.co.il
    via- sa paravur

Windows Server - Groups and Rights

Group	Description	Default User Rights
Account Operators	Members of this group can create, modify, and delete accounts for users, groups, and computers located in the Users or Computers containers and organizational units in the domain, except the Domain Controllers organizational unit. Members of this group do not have permission to modify the Administrators or the Domain Admins groups, nor do they have permission to modify the accounts for members of those groups. Members of this group can log on locally to domain controllers in the domain and shut them down. Because this group has significant power in the domain, add users with caution.	Allow log on locally; Shut down the system.
Administrators	Members of this group have full control of all domain controllers in the domain. By default, the Domain Admins and Enterprise Admins groups are members of the Administrators group. The Administrator account is also a default member. Because this group has full control in the domain, add users with caution.	Access this computer from the network; Adjust memory quotas for a process; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Enable computer and user accounts to be trusted for delegation; Force a shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Allow log on locally; Manage auditing and security log; Modify firmware environment values; Profile single process; Profile system performance; Remove computer   from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects.
Backup Operators	Members of this group can back up and restore all files on domain controllers in the domain, regardless of their own individual permissions on those files. Backup Operators can also log on to domain controllers and shut them down. This group has no default members. Because this group has significant power on domain controllers, add users with caution.	Back up files and directories; Allow log on locally; Restore files and directories; Shut down the system.
Guests	By default, the Domain Guests group is a member of this group. The Guest account (which is disabled by default) is also a default member of this group.	No default user rights.
Incoming Forest Trust Builders (only appears in the forest root domain)	Members of this group can create one-way, incoming forest trusts to the forest root domain. For example, members of this group residing in Forest A can create a one-way, incoming forest trust from Forest B. This one-way, incoming forest trust allows users in Forest A to access resources located in Forest B. Members of this group are granted the permission Create Inbound Forest Trust on the forest root domain. This group has no default members. For more information about creating forest trusts, see Create a forest trust.	No default user rights.
Network Configuration Operators	Members of this group can make changes to TCP/IP settings and renew and release TCP/IP addresses on domain controllers in the domain. This group has no default members.	No default user rights.
Performance Monitor Users	Members of this group can monitor performance counters on domain controllers in the domain, locally and from remote clients without being a member of the Administrators or Performance Log Users groups.	No default user rights.
Performance Log Users	Members of this group can manage performance counters, logs and alerts on domain controllers in the domain, locally and from remote clients without being a member of the Administrators group.	No default user rights.
Pre-Windows 2000 Compatible Access	Members of this group have read access on all users and groups in the domain. This group is provided for backward compatibility for computers running Windows NT 4.0 and earlier. By default, the special identity Everyone is a member of this group. For more information about special identities, see Special identities. Add users to this group only if they are running Windows NT 4.0 or earlier.	Access this computer from the network; Bypass traverse checking.
Print Operators	Members of this group can manage, create, share, and delete printers connected to domain controllers in the domain. They can also manage Active Directory printer objects in the domain. Members of this group can log on locally to domain controllers in the domain and shut them down. This group has no default members. Because members of this group can load and unload device drivers on all domain controllers in the domain, add users with caution.	Allow log on locally; Shut down the system.
Remote Desktop Users	Members of this group can remotely log on to domain controllers in the domain. This group has no default members.	No default user rights.
Replicator	This group supports directory replication functions and is used by the File Replication service on domain controllers in the domain. This group has no default members. Do not add users to this group.	No default user rights.
Server Operators	On domain controllers, members of this group can log on interactively, create and delete shared resources, start and stop some services, back up and restore files, format the hard disk, and shut down the computer. This group has no default members. Because this group has significant power on domain controllers, add users with caution.	Back up files and directories; Change the system time; Force shutdown from a remote system; Allow log on locally; Restore files and directories; Shut down the system.
Users	Members of this group can perform most common tasks, such as running applications, using local and network printers, and locking the server. By default, the Domain Users group, Authenticated Users, and Interactive are members of this group. Therefore, any user account created in the domain becomes a member of this group.	No default user rights.
up	Description	Default user rights
Cert Publishers	Members of this group are permitted to publish certificates for users and computers. This group has no default members.	No default user rights.
DnsAdmins (installed with DNS)	Members of this group have administrative access to the DNS Server service. This group has no default members.	No default user rights.
DnsUpdateProxy (installed with DNS)	Members of this group are DNS clients that can perform dynamic updates on behalf of other clients, such as DHCP servers. This group has no default members.	No default user rights.
Domain Admins	Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain workstations, and all domain member servers at the time they are joined to the domain. By default, the Administrator account is a member of this group. Because the group has full control in the domain, add users with caution.	Access this computer from the network; Adjust memory quotas for a process; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Enable computer and user accounts to be trusted for delegation; Force a shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Allow log on locally; Manage auditing and security log; Modify firmware environment values; Profile single process; Profile system performance; Remove computer from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects.
Domain Computers	This group contains all workstations and servers joined to the domain. By default, any computer account created becomes a member of this group automatically.	No default user rights.
Domain Controllers	This group contains all domain controllers in the domain.	No default user rights.
Domain Guests	This group contains all domain guests.	No default user rights.
Domain Users	This group contains all domain users. By default, any user account created in the domain becomes a member of this group automatically. This group can be used to represent all users in the domain. For example, if you want all domain users to have access to a printer, you can assign permissions   for the printer to this group (or add the Domain Users group to a local group, on the print server, that has permissions for the printer).	No default user rights.
Enterprise Admins (only appears in the forest root domain)	Members of this group have full control of all domains in the forest. By default, this group is a member of the Administrators group on all domain controllers in the forest. By default, the Administrator account is a member of this group. Because this group has full control of the forest, add users with caution.	Access this computer from the network; Adjust memory quotas for a process; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Enable computer and user accounts to be trusted for delegation; Force shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Allow log on locally; Manage auditing and security log; Modify firmware environment values; Profile single process; Profile system performance; Remove computer   from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects.
Group Policy Creator Owners	Members of this group can modify Group Policy in the domain. By default, the Administrator account is a member of this group. Because this group has significant power in the domain, add users with caution.	No default user rights.
IIS_WPG (installed with IIS)	The IIS_WPG group is the Internet Information Services (IIS) 6.0 worker process group. Within the functioning of IIS 6.0 are worker processes that serve specific namespaces. For example, www.microsoft.com is a namespace served by one worker process, which can run under an identity added to the IIS_WPG group, such as MicrosoftAccount. This group has no default members.	No default user rights.
RAS and IAS Servers	Servers in this group are permitted access to the remote access properties of users.	No default user rights.
Schema Admins (only appears in the forest root domain)	Members of this group can modify the Active Directory schema. By default, the Administrator account is a member of this group. Because this group has significant power in the forest, add users with caution.	No default user rights.