Re: Win2008 rights

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

"southpaw" <southpaw@xxxxxxxxxx> wrote in message
news:O41wVF2RKHA.1232@xxxxxxxxxxxxxxxxxxxxxxx

Southpaw, I'm curious,

How is it currently setup this way with one of your forests? Is the user
part of the domain's Domain Administrators group, or do they simply have
local administrator rights on the server in order to allow them to perform
server tasks, such as change the clock, restart, etc?


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS 2008, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA
Messaging
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

Understood but my manager wants it set up that way and was told is
currently setup in one of our Win 2003 forest that way but since I am
responsible to upgrading the DCs to Win2008 I thought I would post the
question how is this possible...

thanks..

"Joe Dunn" <JoeDunn@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:62897382-0410-4ABF-94A3-6D46CA7FEE7E@xxxxxxxxxxxxxxxx

It's not possible. A user must have Administrator rights in the domain
to
shutdown a DC. Therefore they will have rights to view and change
everything
as well.

If you don't trust someone to even view AD why would you want to give
them
the right to shutdown a DC?

Best Regards
Joe Dunn
MBCS, MCSE, MCTS, CCNA


"southpaw" wrote:

Hi,

I want to allow our remote IT support guy to logon to the DC and
perform a
shutdown if needed but not allow viewing AD or making any change on the
DC..
How do I set this up is there a particular group I can add the user.

Win2008 RWDC

Thanks








.

Relevant Pages

  • Re: Normal user login now logs off immediately [w/o administrator
    ... none of my users (all with administrator rights) can ... "WTC" wrote: ... Right click on MountedDevices and select "Permissions". ...
    (microsoft.public.windowsxp.general)
  • Re: Windows Security
    ... > Computers in our Organisation and I am the Administrator of these ... > He thinks that we should give all the Users, Administrator rights. ... Your Boss needs to consider something very important. ...
    (microsoft.public.win2000.security)
  • Using single Programm as Admin under User Profile
    ... logged in as Administrator ... ... User "Admin rights" and everything okay ... ... other "problematic Program" with Administrator Rights ... so "normal User Account" could use this ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Control Panel Applets restrictions
    ... A Power user would only be able to change their password. ... That's the definition of Administrator. ... >>> Looking for a way to restrict user with administrator rights from ... >>> clicking on it brings up the user applet, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Security Issues
    ... If you mean you added that user to the Domain Administrators group keep in ... mind that everyone in this groups is, by design, an administrator on the ... > adding sub sites, still he can create sub sites. ... > if the current user don't have permissions for 'Manage Site Groups', ...
    (microsoft.public.sharepoint.portalserver.development)