Re: Sub Domain Admin Accounts

From: Doug Sherman [MVP] (dsherman_at_nospam.tampabay.rr.com)
Date: 01/31/05 

Date: Mon, 31 Jan 2005 12:17:55 -0500

By default the child domain administrator account will have this ability
because it is a member of the Enterprise administrators universal group.
Other members of the child domain admins group would not have this ability
by default, but check the Enterprise admin group and see whether child
domain admins have been added. See:

http://www.microsoft.com/technet/prodtechnol/windows2000serv/evaluate/featfunc/07w2kadc.mspx

Doug Sherman
MCSE Win2k/NT4.0, MCSA, MCP+I, MVP

"scott" <sbailey@mileslumber.com> wrote in message
news:Oe$ljL1BFHA.1452@TK2MSFTNGP11.phx.gbl...
> I don't want it t, but AD is allowing the sub domain admin accounts to
roam
> the parent domain shares. i can't figure it out.
>
> do you have any good links to teaching drive share permissions/groups?
>
> "Sundaram Narayanan[MSFT]" <sunnar@online.microsoft.com> wrote in message
> news:%23a2OOe0BFHA.1260@TK2MSFTNGP12.phx.gbl...
> > This question is driven by only business and management reasons. There
is
> > no technical reason why an admin accounts in one domain need to access
> > shares in another domain(sub-domain or otherwise). If you have the
> > business/manageability reason to do this add the administrator in
> > otherwise no.
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> > rights. Use of included script samples are subjected to the terms
> > specified at http://www.microsoft.com/info/cpyright.htm.
> >
> >
> >
> > "scott" <sbailey@mileslumber.com> wrote in message
> > news:O5SZLV0BFHA.3708@TK2MSFTNGP14.phx.gbl...
> >> Should an admin account on a sub domain pdc be able to access all
shared
> >> drives on the parent domain and its clients? I have the shares
> >> permissions set on the parent domain pdc drives and all client drives
to
> >> only allow access to Parent Domain Administrator accounts.
> >>
> >> Any ideas?
> >>
> >
> >
>
>

Relevant Pages

  • Re: Queries
    ... Member Of Domain Admins ... Accounts that are members of the Domain Admins Group ... Accounts that are members of the Domain Users Group ...
    (microsoft.public.windows.server.active_directory)
  • Re: Built in Groups Administrators issue in new raised functional
    ... CHILD domain admins are not longer member of the built-in ADMINISTRATORS ... Administrators group this is after an upgrade was ...
    (microsoft.public.windows.server.active_directory)
  • Re: Administrative user accounts no longer has admin privs?
    ... Possibly those accounts are also members of a group that has deny access somewhere to ... > a member of Domain Admins, and Domain Admins is a member ... > Administrators group I'm met with the same message. ...
    (microsoft.public.win2000.security)
  • Administrative user accounts no longer has admin privs?
    ... The accounts I use for administrative tasks has ... a member of Domain Admins, and Domain Admins is a member ... Administrators group I'm met with the same message. ...
    (microsoft.public.win2000.security)
  • Error using Set Up Computer Wizard
    ... When logged on to the SBS 2003 as administrator I fire up the Set Up ... "You must be a member of the Small Business Server Administrators or Power ... I have tried other accounts with other group membership (Domain Admins, ...
    (microsoft.public.windows.server.sbs)