Admin with no Rights to Active Directory

From: DebraH (DebraH_at_discussions.microsoft.com)
Date: 03/16/05 

Date: Wed, 16 Mar 2005 13:31:04 -0800

How do I make someone an admin but take away their rights to making changes
within Active Directory? I would like to give a support user the ability to
logon to Domain Controllers to troubleshoot DHCP, DNS and some applications
that run on the server, but I do not want them to have the ability to make
changes to Active Directory (create or delete OUs, delete admins etc).

Thanks
dhodgkins61@comcast.net

Relevant Pages

  • create support admin user
    ... How do I make someone an admin but take away their rights to making changes ... I would like to give a support user the ability to ... changes to Active Directory ...
    (microsoft.public.win2000.security)
  • Re: Grant Administrative Access to a Domain Controller
    ... Anyone with a good understanding of AD and Windows security will easily see ways of compromising the environment. ... Do not give enhanced rights to Domain Controllers to anyone you don't trust with Domain and/or Enterprise Admins. ... Just know that minimal access can be parlayed into even more access and try as you might, you cannot secure Active Directory from people with server operator or admin or several other levels of access rights on a DC. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Unlock acct permissions
    ... > "Active Directory Design and Deployment" ... > and which Joe referenced. ... >> These are some of the best books out there right now for AD Admin level ... How do I get DSACLS to run on a specific account? ...
    (microsoft.public.win2000.active_directory)
  • Re: Copy Active directory Users to a SQL DB table - Daily
    ... active users in Active Directory incl specified attributes 1,2,3..etc ... ' Connect to SQL Server database. ... I've used UserAccountControl to exclude ... the root, and all admin users in a custom adminOU in the root, a search done ...
    (microsoft.public.windows.server.scripting)
  • Re: Looking to verify users via Active Directory
    ... I'll have an Admin ... How do I search the Active directory? ... Here is a sample that what use lets you test group membership ...
    (microsoft.public.access.modulesdaovba)