Re: Grant Administrative Access to a Domain Controller

Archi,

My colleague Mike is correct in saying you can deny access to Active
Driectory but still allow logon to the DC's. To do this, delegate read
only rights to your restricted administrator to everything within AD
then add that user to the list of accounts that can log on locally to
the dc within the Domain Controller Security Policy. Within the Domain
Controller Security Policy are also options to log on as a service,
etc for management functionality.

I recommend checking out Active Administrator from Scriptlogic to
handle the delegations of control within AD. With Active Administrator
you can easily configure these restricted permission within AD for your
admins via permissions templates that even self heal. Good luck.

Matt


Archi wrote:
We have a group Domain Server Operators and we need to give them admin rights
to domain controllers to restart services, install software and etc. But they
should not have rights to Active directory

"Jorge Silva" wrote:

Hi
Can you explain exactly what do you need to do?
also have a look at :
Step-by-Step Guide to Using the Delegation of Control Wizard
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/ctrlwiz.mspx

--

I hope that the information above helps you.
Have a Nice day.
Jorge Silva
MCSE

"Archi" <Archi@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:24F63807-E425-4294-AFFD-6A36ACD3DB97@xxxxxxxxxxxxxxxx
I need to give admin access to domain controllers for a certain domain
group
but without accessing Active directory.
Any options?


.

Relevant Pages

  • Re: Grant Administrative Access to a Domain Controller
    ... * This posting is provided "AS IS" with no warranties and confers no rights! ... to delegate the appropiate rights. ... Controller Security Policy are also options to log on as a service, ... to domain controllers to restart services, ...
    (microsoft.public.windows.server.active_directory)
  • Re: SMS 2.0 Client on Domain controller fails error 1069
    ... Opened Default Domain Controller Security Policy tab under ... >> Installation method on a pair of AD Domain controllers. ...
    (microsoft.public.sms.setup)
  • Re: Urgent Policy question
    ... able to logon to a domain controller locally unless you changed both Domain ... share to restore default user rights for Domain Controller Security Policy. ... administrator or entering domain administrator credentials when you try to ...
    (microsoft.public.win2000.group_policy)
  • Re: SMS 2.0 Client on Domain controller fails error 1069
    ... Does SMSInternalCliGrp have Logon as a service permissions? ... > Opened Default Domain Controller Security Policy tab under ...
    (microsoft.public.sms.setup)
  • Re: Grant Administrative Access to a Domain Controller
    ... Archi one other thing. ... To clarify, this user cannot be a member of the domain admins group, ... to delegate the appropiate rights. ... Controller Security Policy are also options to log on as a service, ...
    (microsoft.public.windows.server.active_directory)