Re: Grant Administrative Access to a Domain Controller

OK, let me try to ask the question as pointed out by the original poster...

He wants some group of persons to:
(1) install software on a DC
(2) restart services on a DC

He does not want that same group of persons
(3) to be domain admin
(4) change ANYTHING in AD in ANY way...

if you guys (Mike and Matt) feel the problem/issue has been described
correctly, please explain to me in detailed steps how you are going to
configure things so that the original poster is able to accomplish
requirements (1), (2), (3) and (4)...

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"mfarr" <mfarr@xxxxxxxxxxxxxxx> wrote in message
news:1167249029.682242.42270@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Archi one other thing . .

To clarify, this user cannot be a member of the domain admins group,
but shouldn't be if they are not managing AD. Use the capability of AD
to delegate the appropiate rights.

Matt


mfarr wrote:
Archi,

My colleague Mike is correct in saying you can deny access to Active
Driectory but still allow logon to the DC's. To do this, delegate read
only rights to your restricted administrator to everything within AD
then add that user to the list of accounts that can log on locally to
the dc within the Domain Controller Security Policy. Within the Domain
Controller Security Policy are also options to log on as a service,
etc for management functionality.

I recommend checking out Active Administrator from Scriptlogic to
handle the delegations of control within AD. With Active Administrator
you can easily configure these restricted permission within AD for your
admins via permissions templates that even self heal. Good luck.

Matt


Archi wrote:
We have a group Domain Server Operators and we need to give them admin
rights
to domain controllers to restart services, install software and etc.
But they
should not have rights to Active directory

"Jorge Silva" wrote:

Hi
Can you explain exactly what do you need to do?
also have a look at :
Step-by-Step Guide to Using the Delegation of Control Wizard
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/ctrlwiz.mspx

--

I hope that the information above helps you.
Have a Nice day.
Jorge Silva
MCSE

"Archi" <Archi@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:24F63807-E425-4294-AFFD-6A36ACD3DB97@xxxxxxxxxxxxxxxx
I need to give admin access to domain controllers for a certain
domain
group
but without accessing Active directory.
Any options?




.

Relevant Pages

  • Re: What are the user rights required in a domain to authorise DHCP?
    ... When I stated work around I was referring to whether or not there was a KB ... This posting is provided "AS IS" with no warranties, and confers no rights. ... required to delegate this right about 2yrs ago now.. ... If you want to delegate the right to Auth DHCP servers, ...
    (microsoft.public.windows.server.active_directory)
  • Re: What are the user rights required in a domain to authorise D
    ... my test setup. ... Santosh K. ... This posting is provided "AS IS" with no warranties, and confers no rights. ... required to delegate this right about 2yrs ago now.. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Grant Administrative Access to a Domain Controller
    ... To do this, delegate read ... the dc within the Domain Controller Security Policy. ... Controller Security Policy are also options to log on as a service, ... I recommend checking out Active Administrator from Scriptlogic to ...
    (microsoft.public.windows.server.active_directory)
  • Re: Grant Administrative Access to a Domain Controller
    ... Archi one other thing. ... To clarify, this user cannot be a member of the domain admins group, ... to delegate the appropiate rights. ... Controller Security Policy are also options to log on as a service, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Child Local Administrators
    ... delegating Active Directory Service Administration. ... Domain Configuration and DC Administor rights (both of which are ... I would prefer not to grant many admins write access to the configuration ... KB if you are not able to delegate just the required parts. ...
    (microsoft.public.windows.server.active_directory)