In the Reader to Reader article "The Missing Link in Windows' Group Hierarchy"
(July 2006, InstantDoc ID 50022), Murat Yildirimoglu and Ugur Duman point out
that the Windows' group hierarchy is missing a built-in group that can manage
client computers but not domain controllers (DCs) and other crucial servers.
To fill this void, they created a Technicians group, placed the Technicians
group in the Domain Admins group, then removed the Domain Admins group from
the Administrators group in Active Directory (AD) and from the Administrators
group on crucial servers. That way, their technicians can add more than 10 workstations
to the domain. This procedure seems like a lot of work.
At my company, we also created a group for our support technicians. However,
to give this group's members the ability to add more than 10 computers to the
domain, we gave them the Create Computer Objects permission in AD for the appropriate
organizational units (OUs). We also removed the Add workstations to domain
right for authenticated users in Group Policy so that the authenticated
users can't add a workstation to the domain. You can access the Add workstations
to domain option by navigating to Computer Configuration, Windows Settings,
Local Policies, User Rights Assignments.
With this setup, our support technicians can add workstations to the domain
without running into the default 10-workstation limit. We made this group a
Restricted Group for additional security.
—Bill Brower