Re: Admin rights over OU

Tech-Archive recommends: Speed Up your PC by fixing your registry

Thanks for your help Neo!

"neo [mvp outlook]" wrote:

> I found the appendices more helpful for the following reasons...
>
> 1) Appendix covers types of Tasks. (e.g. User Account Manage on page 34 and
> what would need to be delegated to perform a give function.)
>
> 2) Microsoft supplies a delegwiz.inf (replace delegation control template
> file) at the end of the document that greatly expands the out-of-the-box
> experience.
>
> Best words of advice since I work in a very political environment is to
> write out on paper the type of tasks that they need before modify/delegating
> out any rights. Once you get the tasks they need outlined, it makes
> delegation on the supplied templates (or building your own) a snap. (took
> about 2 months of work and many scenerios to get it right on paper first.)
>
> To give you an idea for my site, I was able to create 14 new templates that
> pretty much encompasses what each admin, junior admin, and specialty groups
> need w/out giving them domain admin rights*.
>
> /neo
>
> * if you have exchange 2000/2003 in-house, make sure you take this into
> account as the whitepaper doesn't discuss properties/rights needed for non
> domain admins. just be patient because it is possible to delegation out the
> necessary rights over each object type (groups, users, computers, .etc).
>
> "mpchong" <mpchong@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:61ED2EF7-6EC7-430F-B18A-7121BA105802@xxxxxxxxxxxxxxxx
> > Thank you Simon, Herb and Neo for the replies,
> > I tried to use the delagation wizard, and the OU admin would have rights
> > over users and groups, but what I was confused about was would he have
> > full
> > control over the servers in the ou? Full control meaning being able to
> > install things, etc...
> >
> > Sorry If I was vague in the original post. Neo, I will read the white
> > papers
> > you sent me, will there be anything about wht I need in the paper?
> >
> > Thanks again everyone,
> >
> > Mike
>
>
>
.

Relevant Pages

  • Re: Admin rights over OU
    ... User Account Manage on page 34 and ... Microsoft supplies a delegwiz.inf (replace delegation control template ... pretty much encompasses what each admin, junior admin, and specialty groups ... need w/out giving them domain admin rights*. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Delegation
    ... Hope this helps but make sure uve got full admin rights cos one of the ... delegation rights I gave my admin guy does not allow him to change access ... > What do I click to get to the security option you are referring to? ...
    (microsoft.public.windows.server.active_directory)
  • RE: Delegation of duties to junior administrator
    ... This will help you to be able to customize the delegation ... define templates for use in this wizard. ... That gives members in this group, full admin ... With computers being separate from servers, this only allows the members to ...
    (microsoft.public.windows.server.active_directory)
  • Re: Custom Delegation in AD
    ... You can set up a proxy system where the admin contacts a web page or uses some ... The delegation has to be to the entire attribute or not at all. ... but this grants too many rights. ... >>>users the ability to enable/disable accounts without affecting other rights ...
    (microsoft.public.windows.server.security)
  • Re: Admin rights over OU
    ... Full control of a computer object does NOT ... >> delegation on the supplied templates a snap. ... >> pretty much encompasses what each admin, junior admin, and specialty ...
    (microsoft.public.windows.server.active_directory)