Setting permissions to join or leave the domain
To join a UNIX computer to an Active Directory domain without predefining a computer account, your Active Directory user account must be set with the following permissions:
Select this target object | To apply these permissions |
Parent container object for computer accounts For example: domain/UNIX/Servers
|
On the Object tab, select Allow to apply the following permission to this object only:
Note You can grant this permission to specific users or groups by selecting the Join computers task in the Zone Delegation Wizard. |
To join a UNIX computer to an Active Directory domain and place the computer account in a specific organizational unit (OU), the Active Directory account used to join the domain must be set with the following permissions:
Select this target object | To apply these permissions |
Parent container object for the computer accounts |
On the Object tab, select Allow to apply the following permission to this object only:
|
To join a UNIX computer to an Active Directory domain when you are using a predefined computer account, your Active Directory user account must be set with the following permissions:
Select this target object | To apply these permissions |
Parent container object for the computer account |
On the Object tab, select Allow to apply the following permission to this object only:
|
Computer account object in Active Directory For example, if the computer account is AJAX in the default Active Directory Computers container: domain/Computers/AJAX
|
On the Object tab, select Allow to apply the following permission to this object only:
This permission is required for enabling or disabling a computer account. |
To remove a UNIX computer from an Active Directory domain, your Active Directory user account must be set with the following permissions:
Select this target object | To apply these permissions |
Parent container object for the computer account |
On the Object tab, select Allow to apply the following permission to this object only:
If you are deleting a computer account, you also need the Delete Computer Objects permission. |
Note: This setting only gives the user or group permission to leave an Active Directory domain. If you want to grant permission for a user or group to delete a computer account, you also need the Delete Computer Objects permission.