Domain Join Rights

By default, Active Directory allows each user account to join up to ten devices to the domain. While this may have been acceptable in the ’90s, in today’s age of security - where Zero Trust is the norm - this isn’t optimal.

In this article, we’re going to create and apply a GPO that defines which user accounts are allowed to join devices to the domain. This GPO will be applied to the domain controllers (DCs), as it’s the DCs themselves that control this behavior.

Methodology

The setting we’re modifying is actually located within the Default Domain Controllers GPO. The easiest solution would be to update this GPO directly, but since it’s preferable not to modify any default GPOs, we’ll instead create a separate GPO that overrides it. This approach allows for quick recovery if the changes cause any issues—we can simply unlink our newly applied GPO, and the default GPO will take over again.

Create the GPO

Create a new GPO, configuring the following settings:

1. Browse to Computer >> Policies >> Windows Settings >> Security Settings >> Local Policies >> User Right Assignment.
2. Configure policy Add workstations to domain.
3. Add the security group(s) who will have the ability to join computers to the domain.

Applying the GPO

There are two methods of linking the GPO to override the Default Domain Controllers GPO:

1. Mark the GPO as Enforced so the policy always gets precedence.
2. Change the precedence order on the OU, placing our GPO last to be applied.

Choose your method.