Depending how fancy your Active Directory integration is, you'll want to create a group (either universal, domain, or local) that has the rights to create and the right to remove computer objects. We are dealing with the same situation, but just granting those users these two security permissions (advanced permissions in the properties of the group) will not fully work with our scripting processes for user addition/removal...I've had to assign the users to the Account Operators group to be able to add/remove without problems....and of course I do not want to give them account privledges, but we have yet to come across a better solution. (they are all IT folk in our organization and it's a long story but it wasn't horrible for us to do that given our mixed Novell/NT environment) Your AD environment may differ (ours is somewhat complex due to synching with NDS) so giving those two specific rights should suffice.
The exact security permissions are:
(Under Properties of the Computer container, security, advanced, effective permissions)
Select the group you've created and assign these permissions:
Create Computer Objects
Delete Computer Objects
I'm not completly sure if you need these permissions, but you may need these: (testing would confirm this, which I haven't done yet)
List Contents
Read Permissions
Read All Properties
Hope this helps...do some testing on this, but if in doubt, the Account Operators group has full permission over this, so use that as a baseline. Let me know your results...I am kind of curious the bare minimum you need to do this.
