Add or remove computer objects from a security group in Active Directory
To add or remove computer objects from a security group in Active Directory, the required permissions are similar to those for user objects but are specifically targeted to computer objects. Here are the permissions needed on the security group to manage computer objects as members:
Write Members: This is the primary permission required to modify the "Members" attribute of the group, allowing users to add or remove computer accounts from the group.
Read Members: While not specifically for adding/removing, this permission allows the user to view the current membership list, which can be helpful for verifying changes.
Read and Write Property (optional): In some cases, if additional specific permissions are enforced, the Write Property permission on the group itself may also be required.
Steps to Set Permissions for Computer Object Management
Open Active Directory Users and Computers.
Right-click on the target security group and select Properties.
Go to the Security tab, then click on Advanced.
Click Add to add the user or group that needs permission.
In the Permissions list, check Write Members and Read Members.
These permissions allow specified users to add and remove computer accounts from the security group without needing additional elevated rights, such as "Full Control."