угу, та же статья в оригинале:
http://technet2.microsoft.com/window....mspx?mfr=true
Цитата:
|
Default: Authenticated Users on domain controllers.
|
по теме топика:
Changing the Maximum Number of Computers a User Can Join to the Domain,
откуда следует что этой политикой лучше не злоупотреблять или вообще отключить эту опцию:
Цитата:
|
Another method for granting users the right to add computer objects, although not recommended, is via Group Policy. If you grant the "Add workstation to domain" right via Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment on a GPO that's been linked to the Domain Controllers OU, then users will be able to create computer accounts even if they do not have create child permissions on the default Computers container. This is a holdover from Windows NT to maintain backward compatibility and should not be used unless absolutely necessary. In fact, a good security best practice would be to remove this user right from any user or group objects that do not require it.
|
