Permissions to add workstation to domain but not login locally

Question

I've found several posts describing how to setup an account that can be used to add a machine to AD Domain.  But after trying it I found that account could also be used to login to that same machine locally.  If I try to deny logon locally permission
to the account I create it can not longer add the machine to the domain.
So my question it:  Is it possible to setup a AD user account that can add a machine to a Domain, that can re-add a machine to a domain (which I think needs some delete permissions to remove the old machine account), and can not log on locally to this
or any workstation in the domain?
In case it matters I'm still using an AD in a Server 2008R2 domain.
Thanks

Answer 1

Hi
Havic,
>>When I try those setting, I cannot logon locally with this new account (good).  I can remove it from the domain (good).  I cannot add it back.  I'm getting a:
"The join operation was not successful.  This could be because an existing computer account having the name was previously created using a different set of credentials..."
According to your error message, it is limited by access is denied.
So to solve the problem, please  add the complete set of permission to allow the appropriate users to rejoin the computer accounts in Active Directory.
During my test, these permissions are necessary:
     Create Computer objects
     Delete Computer objects
     Reset Password
     Read and write Account Restrictions
     Validated write to DNS host name
     Validated write to service principal name
Here is the link for how to do: https://support.microsoft.com/en-us/kb/932455
Best Regards
Mary Dong