Re: Grant Administrative Access to a Domain Controller

Ah that was probably mean.

It bothers me greatly that a company that produces tools for AD including Security type tools has support people that have such a core misunderstanding of AD security and they take the time to post their misunderstandings in a public forum in a seemingly authoritative way.

Again, it is not possible to give admin rights to a single DC or even a set of DCs and then lock those same people out of AD. AD is a subordinate service on a DC meaning an Admin can muck with it in any way they want whenever they want regardless of the permissioning in the directory that you think can be done to prevent it. The fact that your tests show this to be the case illustrates your short comings and lack of understanding versus any AD Security capability.

This isn't something I am guessing about. This is something I know because I have "broken" into several ADs that were allegedly locked down. This is without any fancy tricks or tools. The fancy tricks and tools just make it take seconds instead of minutes. This is something I know also because I have spoken to many of the best AD folks inside and outside of Microsoft including the Dev team over the last 6 years and this is a known weakness in all circles. Again this will be helped a little with Longhorn server, but it still won't be solved for the general case.


--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Joe Richards [MVP] wrote:
You know as little about Active Directory and Domain Controllers as your coworker.

Seriously, where are you guys coming from?


--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


mfarr wrote:
Archi one other thing . .

To clarify, this user cannot be a member of the domain admins group,
but shouldn't be if they are not managing AD. Use the capability of AD
to delegate the appropiate rights.

Matt


mfarr wrote:
Archi,

My colleague Mike is correct in saying you can deny access to Active
Driectory but still allow logon to the DC's. To do this, delegate read
only rights to your restricted administrator to everything within AD
then add that user to the list of accounts that can log on locally to
the dc within the Domain Controller Security Policy. Within the Domain
Controller Security Policy are also options to log on as a service,
etc for management functionality.

I recommend checking out Active Administrator from Scriptlogic to
handle the delegations of control within AD. With Active Administrator
you can easily configure these restricted permission within AD for your
admins via permissions templates that even self heal. Good luck.

Matt


Archi wrote:
We have a group Domain Server Operators and we need to give them admin rights
to domain controllers to restart services, install software and etc. But they
should not have rights to Active directory

"Jorge Silva" wrote:

Hi
Can you explain exactly what do you need to do?
also have a look at :
Step-by-Step Guide to Using the Delegation of Control Wizard
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/ctrlwiz.mspx


--

I hope that the information above helps you.
Have a Nice day.
Jorge Silva
MCSE

"Archi" <Archi@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:24F63807-E425-4294-AFFD-6A36ACD3DB97@xxxxxxxxxxxxxxxx
I need to give admin access to domain controllers for a certain domain
group
but without accessing Active directory.
Any options?

.

Relevant Pages

  • Re: Grant Administrative Access to a Domain Controller
    ... MPerrault suggested security, you said "IT CAN BE DONE WITHOUT ANY FANCY ... Joe Richards Microsoft MVP Windows Server Directory Services ... Author of O'Reilly Active Directory Third Edition ... Controller Security Policy are also options to log on as a service, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Grant Administrative Access to a Domain Controller
    ... Anyone with a good understanding of AD and Windows security will easily see ways of compromising the environment. ... Do not give enhanced rights to Domain Controllers to anyone you don't trust with Domain and/or Enterprise Admins. ... Just know that minimal access can be parlayed into even more access and try as you might, you cannot secure Active Directory from people with server operator or admin or several other levels of access rights on a DC. ...
    (microsoft.public.windows.server.active_directory)
  • [NT] Active Directory Stack Overflow
    ... Beyond Security in Canada ... Active Directory, which is an essential component of the Windows 2000 ... A vulnerability in Active Directory allows an attacker to crash and force ... The vulnerability can be triggered when an LDAP version 3 search request ...
    (Securiteam)
  • RE: LDAP + Active Directory
    ... Subject: LDAP + Active Directory ... current article series on Sfocus (An Audit of Active Directory Security)... ... that security in AD can get ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • RE: Read only Admin privileges for Active Directory environment?
    ... the Security log as well, ... 'Read only' Admin privileges for Active Directory environment? ... Our InfoSec team has requested Domain Admin privileges ... Our program offers unparalleled Infosec management ...
    (Security-Basics)