Re: Active Directory Permissions
- From: "Herb Martin" <news@xxxxxxxxxxxxxx>
- Date: Tue, 8 Aug 2006 09:50:06 -0500
"Wirelondon" <Wirelondon@xxxxxxxxx> wrote in message
news:1155015181.887393.214010@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I have been asked by manager to setup access for the Helpdesk Team to
access the Active Directory.
I need some advice, as I asked what access should I give the Helpdesk
team he replied "give them same access as you" But I don't want
them having full control.
Our helpdesk team is 3 people who look after all 1st line & 2nd line
support issues.
Has anyone else been asked to grant people access, but not wanting to
give them full control?
Read the other responses which are correct (Florian, Joe, Paul).
It might help you to know the following:
Active Directory and with it Win2000/2003 server contain numerous
features designed specifically to allow for the appropriate delegation
of control to those who need additional authority.
This control cannot only be delegated incrementally, it can be delegated
over subsets of the domain, usually at the OU level (but technically all
the way down to a single property on a single user.)
So, yes, many people have faced this issue and Microsoft designed
the new systems to meet these requirements.
Take a look at AD Users and Computers, right click on an OU and
notice that there is a "Delegation of Control" wizard that lets you
easily delegate the most common tasks requiring delegation.
More sophisticated delegations can be performed through the actual
PERMISSIONS on each AD object (if you understand NTFS permission
then you can loosely think of OUs like directories and users/computers
like files -- although most admins don't really understand NTFS
thoroughly) or you can delegate some things like control over services
conveniently in Group Policy.
Microsoft has already provided examples of service delegation in
Win2003 by creating groups called "DHCP Users" and "WINS
Users" that have read only access to the DHCP and WINS console
and data. ("User" is a slight misnomer because this is not about
ordinary users.)
These two groups are typically use specifically to give the Help
Desk the ability to FIND a DHCP or WINS problem when helping
a user but require them to call a "real admin" to make any changes
if and only if changes are necessary.
Joe gave you some pointers to white papers and the above may
give you the basic philosophy of Win2000+ and AD.
--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]
Many thanks
Phil
.
- References:
- Active Directory Permissions
- From: Wirelondon
- Active Directory Permissions
- Prev by Date: Re: Active Directory Permissions
- Next by Date: Slow logins to AD across VPN
- Previous by thread: Re: Active Directory Permissions
- Next by thread: renaming a computer
- Index(es):
Relevant Pages
|
