Security

Ask something
Discussion Locked

Delegate Workstation Admin

0 helpful
5 replies

by tech_guy1

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We are running W2003 across 3 sites with 1 domain.

Each site has their own OU.
Example ("Sharonville OU w/ Users, groups, etc.", "Madison w/Users, Groups, Etc.", Hamilton w/Users, Groups, Etc, and Corporate with the same).

We have hired a tech in the Madison Facility/OU and would like to give him admin access to the local workstations to manage them etc. without have to go to each workstation. It there a way to do this.

I was thinking about doing the following.

Create a GPO in the Madison OU. Add a restricted group called Madison_Admin and add the users needed to this, but I am not sure how it works.

Another Idea I was was to create a group in ad called Madison_admin and add the users, but haven't figured out how to add that group to the local admin group. Any ideas?

Thanks,

Tech Guy

5 replies

by cg it

what admin tasks? just deal with workstations? reset passwords? create user accounts?

I would just suggest that you use the delegation of control wizard and delegate what you want the tech to do to the Madison OU. The user doesn't need to be a member of the domain admins security group.

by cg it

create a group call Madison Admins in the Madison OU. delegate to that group and add the guy to that group. Audit account management.

by tech_guy1

I already have him delegated in the OU. I am talking about the maintenance tasks on the workstations. For example: The ability to install software in individuals pc, access to system files to clean viruses, etc. He does not and will not need access to admin the servers, just the workstations.

When I set him up to delegate the OU, he can create user accounts, etc. but still can't get full logon rights to the workstations for maintenance issues above.

by cg it

workstations only ok....

Well, first a question, do you really want someone who is able to install software on the local machine? Invariably, that account will be compromised which means anyone can log on locally to the machine and install whatever software.

If the answer is yes, then create a power user account that is on all workstations. He can use the power user account to install software locally.

I would still suggest software deployment through Active Directory rather than a local machine install, but a power user account should be sufficent privileges rathern than an admin account.

by cg it

as we said create an account that is a power user account for maintenance of workstations. Giving the guy the local machine admin account, as we said will get compromised. You'll have everyone logging on locally so they can play games or install software they want. Why log on to the domain?

This discussion is closed to new replies.