Re: Grant Administrative Access to a Domain Controller

Then you aren't dealing with very informed people. Getting into AD that you have no rights in but you do have access to isn't all that involved. If you already have rights it is that much easier.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm




Of course you can lock yourself out of AD. I've seen it happen all the
time.

Michael P. Perrault
MCSE, CCNA, A+, MBA
Senior Systems Engineer,
ScriptLogic Corporation

Michael.Perrault@xxxxxxxxxxxxxxx
www.scriptlogic.com
http://groups-beta.google.com/group/scriptlogic-desktop-authority

.

Relevant Pages

  • Re: Delegating printer rights to Domain Controllers
    ... If he has rights to update system files on a single DC, he can get any rights in the forest he wants. ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • Re: Account Operators accessing other account operators
    ... Joe Richards Microsoft MVP Windows Server Directory Services ... Author of O'Reilly Active Directory Third Edition ... As soon as I get a chance, I will have a look at delegation to resolve my issues and remove the security hole. ... I know that I shouldn't have domain admin rights - I have only recently taken over the administration of our domain and network and already had it on my list to remove my rights and use Run As as necessary - this was how I worked in my previous job and this is how I intend to work in this one. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Administrative rights on specified domain controller
    ... As Jorge said though, if you give someone rights to modify a DC, be honest about it and make them a domain or enterprise admin because if they have any sense they can quickly attain that status. ... Joe Richards Microsoft MVP Windows Server Directory Services ... "myweb" wrote: ...
    (microsoft.public.win2000.security)
  • Re: Server operator Group
    ... Serv Ops have more rights over a DC than power users have over other machines. ... both security principals can easily be used to escalate to administrator rights. ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • Re: Effective Permissions
    ... I want to know what rights they have to said object via all of their groups. ... I do an effective permissions on the user and it will show me their ... Josh Messerschmitt ... > Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.active_directory)
Loading