RE: [ActiveDir] Joining Workstations to our domain

[Mike Hogenauer]

Mark,   I personally wouldn’t consider doing this but I can see why you might want to. AD can make your firewalls look like swish cheese. You could create an account for your vendor and delegate that account to join workstations to the Domain.   http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/deploy/confeat/adrepfir.mspx     Ports RPC endpoint mapper 135/tcp, 135/udp Network basic input/output system (NetBIOS) name service 137/tcp, 137/udp NetBIOS datagram service 138/udp NetBIOS session service 139/tcp RPC dynamic assignment 1024-65535/tcp Server message block (SMB) over IP (Microsoft-DS) 445/tcp, 445/udp Lightweight Directory Access Protocol (LDAP) 389/tcp LDAP over SSL 636/tcp Global catalog LDAP 3268/tcp Global catalog LDAP over SSL 3269/tcp Kerberos 88/tcp, 88/udp Domain Name Service (DNS) 53/tcp1, 53/udp Windows Internet Naming Service (WINS) resolution (if required) 1512/tcp, 1512/udp WINS replication (if required) 42/tcp, 42/udp       Hope that helps,   Mike   From: Creamer, Mark [mailto:[EMAIL PROTECTED] Sent: Friday, April 30, 2004 5:15 AM To: [EMAIL PROTECTED] Subject: [ActiveDir] Joining Workstations to our domain   Good morning, I’d like to see what the group thinks about this. We have a vendor who prepares PCs for us with our image, and then ships them out to our field locations pre-configured. They’d like to take that a step further, and actually pre-join the PC to the domain before it leaves their facility. To do this, we would have to set up a secure connection between our facility and the vendor’s. If we do this, I’d obviously like to make this as limited as possible in terms of what the user at the vendor is allowed to do.   My initial thoughts are: see if I can determine what ports are needed for a PC to join a domain, and limit the ports to those see if I can limit the rights of the vendor “user” to be able to do nothing but join a PC to the domain   Right now, I have no idea if this is a good idea, common practice, etc., so I’m very interested in the advice from this list – especially if there might be a good solution to this problem other than the way we’re considering. Thanks as always,   Mark Creamer Systems Engineer Cintas Corporation Honesty and Integrity in Everything We Do