Re: Creating new groups
- From: "Florian Frommherz [MVP]" <florian@xxxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 16 Feb 2009 11:34:40 +0100
Howdie!
BeckyBoo123 wrote:
I am trying to create a new group for support staff. I would like to give them restricted admin rights, eg access to Terminal Services Manager for remote control purposes while disallowing other admin rights.
I thought the easiest way to do this would be to copy the domain admin profile and change what I needed to but there seems to be no option to do this.
You should go the other way round. From a security perspective, the only valid approach would be: use a blank user profile and assign it permissions it needs to fulfill it's tasks.
I must admit that I'm not a Terminal Services guy so for the Terminal Services Manager I don't have a solution right-away. For all other DS tasks they need access to, you can use the "Delegation of Rights" wizard in Active Directory Users and Computers (right-click an OU you want them to have permission on).
Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste
.
- References:
- Creating new groups
- From: BeckyBoo123
- Creating new groups
- Prev by Date: Re: Automatic backups of clients documents
- Next by Date: GPO desktop and files max size
- Previous by thread: Creating new groups
- Next by thread: Re: Creating new groups
- Index(es):
Relevant Pages
|
