If you work on a larger network there will always be an example of when you need IT staff to have more permissions to accomplish certain tasks, while hoping to keep them from having the keys to the castle. Making all of your staff domain admins with full access to everything will allow them to do any tasks that come their way, but can also be risky. When faced with this decision, as network administrators or IT Directors, the challenge we are really facing is finding the right balance between getting the work done quickly which may increase risk, or having the work take a little longer thereby reducing the risk. The decision we make can be based on many things including:
- Who is being affected by a particular issue
- How much we know and trust the person we are giving the increased access to
- The work environment itself
- The nature of the data we are trying to protect
- A variety of other factors
One permission that can easily be given, without giving full access to the entire network, is the permission to add unlimited devices to the domain. Adding devices to the domain is necessary for any newly purchased devices, devices that have been rebuilt due to a hardware or software failure, renaming a device, in addition to various other issues and troubleshooting.
To assign this permission to users or groups, follow the steps below:
