Re: Secure an Administative Group

When a computer is joined to the domain, the group "Domain Admins" is added
to the local Administrators group. This allows members of this group to
add/remove users to the local Administrators group. You could add another
domain group to the local Administrators group to give users that do not
have "Domain Admin" privileges admin privileges on the local machines. This
can be done with Restricted Groups or a VBScript program that adds the
domain group to each computers local Administrators group.

A group can be given permission to add compouters to the domain by granting
the following privileges:

Reset Password

Validated write to DNS host name

Validated write to service principal name

Write Account Restrictions



To grant permission to create, edit, unlock, disable, and change passwords,
but not delete users, you may need to deny the delete privilege. Deny
overrides grant. Someone else may have more detail.


--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--
"a_user" <auser@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:3F227F5C-A4E4-4AC5-8AD8-373A99AA5A95@xxxxxxxxxxxxxxxx
I meant to also add to this we need to ability to have our helpdesk staff
be
able to add a user to the local administrator group on desktops and
laptops
without them having domain admin rights.



"a_user" wrote:

Similiar to a previous post I am looking for a guide to create a limited
locked down group for AD administration for our HelpDesk group.

I want to allow very limited functionality. Namely the following:

Allow joining of computers to domain (unlimited, more then 10 limit)
Create users
Edit users
Unlock users
Change user passwords
Disable Users
Create groups
Edit group memberships

I do NOT want helpdesk group to have the ability to delete objects like
users, groups or computers.

I tried using the delegation wizard but there are far to many options
when
trying to get granular and not using just the default option of adding a
computer to a domain.

I tried adding the helpdesk group to the domain security settings and
enabling write permission and disabling delete options. Users in this
group
can still delete user accounts, groups and computers from different OU's.

Is there a guide somewhere that steps through this process? I cant belive
it
should be this hard or that nobody else has done this before but the
documentation I have been able to find has been very limited without
supplying irrelavant or overwhelming and confusing information.

Please help.

Thanks!!


.

Relevant Pages

  • Re: Domain Admin Account deleted by local Admin
    ... > domain admin from local administrators group. ... or programs that should be install remote like antivirus client ... > users on their computers is not a sollution. ...
    (microsoft.public.windows.server.active_directory)
  • Re: How do I get admin rights for all objects in a OU?
    ... You do not need to be a domain admin to do that. ... account into the local administrators group. ... Restricted Group GPO to the OU that contains all your computers. ...
    (microsoft.public.windows.server.active_directory)
  • Re: how to schedule a job or run a script with elevated privleges?
    ... schedule a job or run a script ... the local Administrators group when the computer is joined to the domain). ... You could create a script to run remotely on all computers in an OU (or in a ... group or all computers in the domain) in bulk using WMI. ...
    (microsoft.public.scripting.vbscript)
  • Re: AD to desktop Permissions problem
    ... account to the local administrators group on her workstation without making ... her a Domain Admin. ... The former proffers admin rights to a single ... workstation, the latter to your entire domain. ...
    (microsoft.public.windows.server.general)
  • Re: Group Policy
    ... administrators group of all computers in the domain. ... restricted groups, however this GP setting will remove all the users ... to add a domain group to the local administrators group ...
    (microsoft.public.windows.server.active_directory)