Re: securing critical member servers
- From: "Paul Bergson [MVP-DS]" <pbergson@xxxxxxxxxxxxxxxxx>
- Date: Thu, 17 Jul 2008 07:46:02 -0500
Once a user is in the administrators group they can do anything they choose
including readding themselves into groups and removing any restrictive
permissions. If you have admins you don't trust then they shouldn't be
admins in the first place.
--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
<zerbie45@xxxxxxxxx> wrote in message
news:3197edec-49f6-4b86-9441-5f2e9ad4da25@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
hello,
we have a windows 2003 active directory and have a couple of servers
used for a very critical application (banking industry).
these servers are placed in a dedicated organizational unit and do
receive standard group policy we apply to all member servers.
however, given the particular sensitivity of the application data held
in these servers we would like to logically/Active Directory "isolate"
it from the rest of the domain, where possible.
this does not involve ipsec (servers are in a separate firewalled dmz
and traffic is already ciphered), but we would like to use gpos to
remove regular domain admins from the possibility of administering the
servers and replacing them with a dedicated domain group.
What I need to do basically I think is to use OU delegation and remove
standard domain admins and explicitely add the group we want to use
for server administration.
Anybody can give any recommendations ? I've seen many hardening
guides, they do lock down many features but they don't bother much
with removing normal domain admins rights.
thanks!
zz
.
- References:
- securing critical member servers
- From: zerbie45
- securing critical member servers
- Prev by Date: Re: Users see all Users Folders instead of just Individual User Folder
- Next by Date: Re: 2003 Trusts and adding 2008 AD
- Previous by thread: Re: securing critical member servers
- Next by thread: see windows information
- Index(es):
Relevant Pages
|
