Scenario:
In my active directory is have an OU named creative. In there I have a security group and a handful of users that are members of this group. In my group policy I have a powershell script that runs. This script simple checks the logon name that was used to log in and renames to computer to "cr" + the log in name. This way we know the computer name to each user. (There are other reason we need to do this but that is not relevant.) It also does some checks to make sure the computer doesn't already exist.
What I've done:
Log in. Script runs and returns an error saying that access is denied. After digging around I decided to add the user to domain admin group. The script works perfectly.
So I have verified that the script works. However I can not leave each user as a domain admin.
Question:
Were on Server 2012 can I give permission to this security group so that all members are able to rename the computer?
Thank you in advance. I am ripping my hair out trying to find were to set this.