Hi,
So I have been having a bit of trouble removing domain admin rights from my local deployment staff that use Windows Deployment Services.
I gave their domain accounts the right to make computer accounts and change computer properties, I also gave them full admin rights on the WDS machine and also over the AD Object. I even tried modifying the registry for the PXE devices user from the default setting of Domain Admin.
But they keep getting permission errors when trying to modify pre-authorized devices or authorize any pending devices.
I keep reading that I need to delegate them full control over the SCP object under the WDS server object, but it is not there (no Remote Install Tab either)
I checked adsiedit as well as view > advanced features & show AD objects as containers.
There is a Technet article that says I should restart the WDSService as it is meant to create the SCP object when the service starts and continues by making sure the server can access the domain controllers (which it can).
All of my WDS servers are VM's running in a vSphere environment. When the user is a domain admin, there is no problem.
If there something different with 2012 R2? Or is it that they are running on VM's? I can't imaging that being an issue though as it works perfectly except for the SCP issue.