domain account permission & policy

To any expert out there, i have trouble creating a domain acount which allow my fellow network staff only have the domain account rights (without giving them administrator rights) to :

-- Join client pc to domain.
-- Share network printer
-- share printer connected (USB) to a joined domain client pc, so others client pc is able to print to the printer connected to that pc.

Thanks for reading and help in advance

Bullz

 

power users on local pc will allow them to do all those things

if you want him to add PCs to domain you need to delegate that permision in ADUC.

You can also precreate the acconts in AD and then he will be able to join the domain without rights or need to delegate.

http://www.jsifaq.com/SF/Tips/Tip.aspx?id=8144

 

Thanks for replying my post, BILBUS.

There is a situation when network point for network printer not enough for user to use, we got no choice and connect the printer to one of the client pc (USB cable) and share the printer, so others in the dept is able to print to that printer. Since all the dept PC is joined to DOMAIN, when try to install, a login screen will popup and an adminitrative domain account is needed before we can add the printer to other client pc. I dont want to give too much administrative domain account to my fellow network staff for security reason.

My boss is asking me to give our network staff only can join to domain and add printer in a situation when a printer is connected to a pc thru USB of a joined domain PC.

 

I'm fairly sure that a Domain Administrator automatically gets local Administrator rights. However there are a lot of other default local groups and one of those might suit. For example "Print Operators "

 

domain admins are members of local admin groups

why not buy a 30$ print server box, i have a few netgrear print servers and they work well. Install the PS on the back of the printer, asign a IP, add printer to server, share printer off server. now all clients can add the printer ...