حذف قابلیت جوین کردن ۱۰ کامپیوتر به دومین توسط یوزرها

[RIGHT][FONT=courier new]به صورت استاندارد هر یوزر شناسایی یا تصدیق شده[/FONT][FONT=courier new] authenticated User [/FONT][FONT=courier new]میتواند [/FONT][B][COLOR=red][FONT=courier new]۱۰[/FONT][/COLOR][/B][FONT=courier new]کامپیوتر را به دومین[/FONT][FONT=courier new] Join [/FONT][FONT=courier new]کند[/FONT][FONT=courier new] .[/FONT][/RIGHT]
[RIGHT][FONT=courier new]اگر بخواهیم این قابلیت را برای یوزرها حذف کنیم، از راه زیر استفاده میکنیم[/FONT][FONT=courier new] .[/FONT][/RIGHT]
[RIGHT][FONT=courier new]کنسول[/FONT][FONT=courier new] ADSIEdit [/FONT][FONT=courier new]را باز میکنیم[/FONT][FONT=courier new] .[/FONT][/RIGHT]
[URL="http://social.technet.microsoft.com/wiki/cfs-file.ashx/__key/communityserver-wikis-components-files/00-00-00-00-05/8231.1.jpg"][IMG]http://social.technet.microsoft.com/wiki/resized-image.ashx/__size/550x0/__key/communityserver-wikis-components-files/00-00-00-00-05/8231.1.jpg[/IMG][/URL]

[URL="http://social.technet.microsoft.com/wiki/cfs-file.ashx/__key/communityserver-wikis-components-files/00-00-00-00-05/7220.2.jpg"][IMG]http://social.technet.microsoft.com/wiki/resized-image.ashx/__size/550x0/__key/communityserver-wikis-components-files/00-00-00-00-05/7220.2.jpg[/IMG][/URL]

[RIGHT][FONT=courier new]بعد از باز شدن کنسول، روی[/FONT][FONT=courier new] ADSIEdit [/FONT][FONT=courier new]کلیک سمت راست موس را کرده و[/FONT][FONT=courier new] Connect to [/FONT][FONT=courier new]را انتخاب میکنیم[/FONT][FONT=courier new] .[/FONT][/RIGHT]
[URL="http://social.technet.microsoft.com/wiki/cfs-file.ashx/__key/communityserver-wikis-components-files/00-00-00-00-05/7178.3.jpg"][IMG]http://social.technet.microsoft.com/wiki/resized-image.ashx/__size/550x0/__key/communityserver-wikis-components-files/00-00-00-00-05/7178.3.jpg[/IMG][/URL]
[RIGHT][FONT=courier new]
Default naming context[/FONT][FONT=courier new] را انتخاب کرده و[/FONT][FONT=courier new] OK [/FONT][FONT=courier new]را کلیک میکنیم[/FONT][FONT=courier new] .[/FONT][/RIGHT]
[URL="http://social.technet.microsoft.com/wiki/cfs-file.ashx/__key/communityserver-wikis-components-files/00-00-00-00-05/82823.4.jpg"][IMG]http://social.technet.microsoft.com/wiki/resized-image.ashx/__size/550x0/__key/communityserver-wikis-components-files/00-00-00-00-05/82823.4.jpg[/IMG][/URL]

[URL="http://social.technet.microsoft.com/wiki/cfs-file.ashx/__key/communityserver-wikis-components-files/00-00-00-00-05/1067.5.jpg"][IMG]http://social.technet.microsoft.com/wiki/resized-image.ashx/__size/550x0/__key/communityserver-wikis-components-files/00-00-00-00-05/1067.5.jpg[/IMG][/URL]

[RIGHT][FONT=courier new]حالا روی نام دومین[/FONT][FONT=courier new] DC=Contoso,DC=Com [/FONT][FONT=courier new]کلیک سمت راست کرده و[/FONT][FONT=courier new] Properties [/FONT][FONT=courier new]را کلیک میکنیم[/FONT][FONT=courier new] .[/FONT][/RIGHT]
[URL="http://social.technet.microsoft.com/wiki/cfs-file.ashx/__key/communityserver-wikis-components-files/00-00-00-00-05/5282.6.jpg"][IMG]http://social.technet.microsoft.com/wiki/resized-image.ashx/__size/550x0/__key/communityserver-wikis-components-files/00-00-00-00-05/5282.6.jpg[/IMG][/URL]

[RIGHT][FONT=courier new]حالا [/FONT][B][COLOR=red][FONT=courier new]ms-DS-MachineAccountQuota[/FONT][/COLOR][/B] [FONT=courier new]را پیدا میکنیم. همانطور که میبینید، مقدار آن به صورت استاندارد [/FONT][B][COLOR=red][FONT=courier new]۱۰[/FONT][/COLOR][/B][FONT=courier new]میباشد[/FONT][FONT=courier new] .[/FONT][/RIGHT]
[URL="http://social.technet.microsoft.com/wiki/cfs-file.ashx/__key/communityserver-wikis-components-files/00-00-00-00-05/8865.7.jpg"][IMG]http://social.technet.microsoft.com/wiki/resized-image.ashx/__size/550x0/__key/communityserver-wikis-components-files/00-00-00-00-05/8865.7.jpg[/IMG][/URL]

[RIGHT][FONT=courier new]مقدار آن را به صفر[/FONT][B][COLOR=red][FONT=courier new] 0 [/FONT][/COLOR][/B][FONT=courier new]تغییر داده و[/FONT][FONT=courier new] OK [/FONT][FONT=courier new]را کلیک میکنیم[/FONT][FONT=courier new] .[/FONT][/RIGHT]
[URL="http://social.technet.microsoft.com/wiki/cfs-file.ashx/__key/communityserver-wikis-components-files/00-00-00-00-05/8032.8.jpg"][IMG]http://social.technet.microsoft.com/wiki/resized-image.ashx/__size/550x0/__key/communityserver-wikis-components-files/00-00-00-00-05/8032.8.jpg[/IMG][/URL]

[FONT=courier new]از این به بعد یوزرها دیگر نمیتوانند کامپیوتر به دومین[/FONT][FONT=courier new] Join [/FONT][FONT=courier new]کنند. اگر میخواهید به یک یوزر یا گروه قابلیت[/FONT] [FONT=courier new] Join [/FONT][FONT=courier new]کردن کامپیوتر به دومین را بدهید، از[/FONT][FONT=courier new] Active Directory Delegation [/FONT][FONT=courier new]استفاده کنید[/FONT][FONT=courier new]

[/FONT][FONT=courier new]منبع : [/FONT]microsoft[FONT=courier new]
[/FONT]

لینک زیر در خصوص اینکه چگونه بررسی میشود فرد دارای دسترسی جوین سیستم به دومین هست یا خیر توضیحات بسیار خوبی ارائه داده

[url=http://www.msresource.net/knowledge_base/articles/info:_how_does_ms-ds-machineaccountquota_work.html]msresource.net - INFO: How does mS-DS-MachineAccountQuota work?[/url]


[h=1]Permissions Validation[/h] When a user attempts to join a computer to the domain, the authenticating Domain Controller checks to see if the user context performing the operation has the CREATE_CHILD permission for computer objects on the parent container (by default this is CN=Computers, DC=DNS-domain-name, however this can be redirected in 2003 functional mode). If the user context has this permission the check succeeds and the user can add the workstation to the domain without exception. If the user context doesn't have [computer] CREATE_CHILD permissions, then the user right SE_MACHINE_ACCOUNT_PRIVILEGE (Add workstations to the domain) is checked. If the user has this right, then the user can continue to add the workstation to the domain if the quota defined is not exceeded. If the user doesn't have this right, then the user cannot add a workstation to the domain.

[B]Note[/B]. By default, the Authenticated Users security principal has the right SE_MACHINE_ACCOUNT_PRIVILEGE.
This series of events looks something like this:
[LIST][*]User attempts to join machine to the domain (local administrator permissions required)[*]Domain Controller checks to see if user has permissions to create computer objects in the default computers container.[*]If the user has the necessary permissions, [I]ms-DS-MachineAccountQuota[/I] is not checked. Operation will succeed.[*]If the user doesn't have the necessary permissions, the Domain Controller checks to see if the user has the user right "Join workstations to the domain".[*]If the user has the necessary right, [I]ms-DS-MachineAccountQuota [/I]is checked. Operation will succeed if the number of objects created by this user is less than that defined in [I]ms-DS-MachineAccountQuota[/I].[*]If the user has neither the create computer object permission or join workstations to the domain right then the operation will fail and the user is notified that they do not have permissions to carry out the request. If the user has the right Join workstations to the domain but has exceeded the value defined in [I]ms-DS-MachineAccountQuota[/I] then the operation fails and the user is notified that he/ she cannot join any more machines to the domain.[/LIST]

[h=1]Quota Validation[/h] If the necessary permissions are not held by the user in question, the Domain Controller then checks to see if the user is allowed to add this computer to the domain based on the domain-quota for domain membership additions. To do this check, the Domain Controller searches the domain for any computer objects where the [I]ms-DS-CreatorSID[/I] equals the [I]objectSID [/I]of the user performing the operation. If the number of computers returned by the query is less than the quota defined in[I] ms-DS-MachineAccountQuota [/I]then the account is created, the [I]ms-DS-CreatorSID[/I] attribute is stamped with the SID of the user ([I]objectSID[/I]) and the owner of the new computer object is set to Domain Admins.

[B]Note[/B]. [I]ms-DS-CreatorSID[/I] is indexed, therefore this is a very fast search.
This series of events looks something like this:
[LIST][*]User allowed to create computer objects if quota not exceeded, therefore check quota[*]If (&(objectCategory=computer)(ms-DS-CreatorSID=objectSID)) returns fewer results than the value of ms-DS-MachineAccountQuota then[*]Create computer, set ms-DS-CreatorSID to the SID of the user and set Domain Admins as the owner[/LIST]

[B]Note[/B]. Due to the way that this works, the quota is only loosely enforced. That is, a user cannot add more computers to the domain than the quota if all previous computer accounts created exist. In addition, it might be possible to add one or two computers that actually exceed the value defined in the quota.

As an example, if a computer account was created in the past and the computer decommissioned (and the object removed from Active Directory) then the count returned by the LDAP query will be number of computers joined to the domain - number of computer objects that were joined but are no longer in the directory. Which means another computer can be added.

As another example, it is also possible that more than the quota value can be added if the user in question were able to target multiple Domain Controllers within the replication latency. However, this isn't really easy to do and wouldn't cause much of an exception to the quota if it did happen.