Computer Migrators
The overall purpose of the <Root OU>-Computer Migrators groups was to be able to delegate ability for more users than just the OU admins to add machines to the domain. Joining a computer to the domain that has been pre-staged is treated slightly differently from non-pre-staged, but setting up the permissions as listed below will allow the migrators group to perform both types of joins.
Setting Up Permissions
The <Root OU>-Computer Migrators groups have been delegated “Add workstations to domain” user right, and the ability to create computer objects under the Computers container. This allows any members of this group the ability to add a computer to the domain. All of the <Root OU>-OU Admins groups already had these rights. The intention is for each unit to then grant their <Root OU>-Computer Migrators group access to their OU.
These are the permissions required to join a Windows client to AD:
Computer Objects: Allowed to Authenticate
Computer Objects: Change Password
Computer Objects: Reset Password
OU Descendant Computer Objects: Create Computer Objects
OU Descendant Computer Objects: Delete Computer Objects
These are the permissions required to join a Linux client to AD:
Computer Objects: Allowed to Authenticate
Computer Objects: Change Password
Computer Objects: Reset Password
Computer Objects: Write operatingSystem
Computer Objects: Write operatingSystemHotfix
Computer Objects: Write operatingSystemServicePack
Computer Objects: Write operatingSystemVersion
OU Descendant Computer Objects: Create Computer Objects
OU Descendant Computer Objects: Delete Computer Objects
Likely usage scenarios:
1. Helpdesk staff – A given college or department might have junior staff that need to handle the addition of computers to the domain, but are not going to have full AD rights over the OU. Generally, an OU admin would then grant the pre-created <Root OU>-Computer Migrators group the ability to create computer accounts under the OU. This would then allow the junior staff member to add the computer to the domain, and then move the computer object from the Computers container to the appropriate OU (or preferably to create within the correct OU to start).
2. Faculty/Staff – If a unit was migrating a large amount of faculty/staff from a non-managed (or Workgroup) environment to the domain, the given college or department might want to add all of their faculty/staff to the <Root OU>-Computer Migrators group. This would allow the faculty/staff to add their own machines to the domain using their Unity username/password. The OU Admin might then move all of the computer objects to the appropriate OU’s where GPO settings would then configure the machines. This would allow for a very quick migration. The faculty/staff would later be removed from the group to reduce permissions down to an appropriate level.