Re: Needing advice for administrative rights....

From: Joe Richards [MVP] (humorexpress_at_hotmail.com)
Date: 03/05/05 

Date: Sat, 05 Mar 2005 12:08:32 -0500

You should create a group in your domain called something like PCAdmins. Then
add that group to every PC you have. Then you add the PCAdmin users to the
PCAdmin group. It takes a little bit to set up but once configured, you only
have to do a little maintanence. You can add the group to all PCs with a group
policy on the OU that the PCs live in. Basically looked at restricted groups.

As for AD, it is full set to be delegated in whatever manner you want. I
recommend web surfing for search strings such as "active directory delegation"
and such. Also it wouldn't hurt you to pick up some book and read them like the
O'Reilly Active Directory book (Cat Book).

   joe 

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net
Cheryl wrote:
> We currently have a situation all technicians are domain administrators. We 
> have a number of trainees that we would like to be able to just install 
> software and view parts of active directory. 
> 
> The viewing part is easy but the trainee cannot install software on a PC if 
> they are not domain administrators. Is there any way around this? I know i 
> can assign the trainee local administrator rights on the client PC's but we 
> have many PCs and many trainees so it is not a practicle solution.
> 
> From my experience domain administrators seem to be able to administer 
> active directory without any restrictions. Is this right? Could i remove this 
> some how and assign individual people, without assigning the domain 
> administrators group. Then i could assign the trainees domain admins so they 
> can install their software on the PC's on the network.
> 
> I hope this makes sense to who ever is reading it.
> 
> Does anyone have a solution?
> 
> Cheryl
> 
> Auto Response doesnt always work, email: chezp200@hotmail.com

Relevant Pages

  • Re: Needing advice for administrative rights....
    ... >> We currently have a situation all technicians are domain administrators. ... >> have a number of trainees that we would like to be able to just install ... >> software and view parts of active directory. ... >> have many PCs and many trainees so it is not a practicle solution. ...
    (microsoft.public.windows.server.active_directory)
  • Needing advice for administrative rights....
    ... We currently have a situation all technicians are domain administrators. ... have a number of trainees that we would like to be able to just install ... have many PCs and many trainees so it is not a practicle solution. ...
    (microsoft.public.windows.server.active_directory)
  • Re: restricting users from accessing a computer.
    ... domain administrators group for good measure). ... look in the Local Security Policy under Security Settings | ... > Windows 2000 active directory and all the users are ... > members of the active directory. ...
    (microsoft.public.win2000.security)