Windows Forum

Ask something
Discussion Locked

Active directory question

0 helpful
3 replies

by packet spoofer 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
does it not make sense that a person that has the authority to manage high level administrative group membership be an administrator, domain admin etc? I have been tasked with cleaning up admin by reducing and delegating administrative tasks, but am experiencing administrative overlap that seems to require domain admin membership for certain people. I have created 2 groups and have not been able to create a group with non domain admin members, that can add members to the domain admin group....even with full control at the highes level.....Am I missing something?

3 replies

by sysengineer

If you are creating a group for the purpose administering accounts you can add the users to the Account Operators Group which will give the users access to change/modify accounts but will not give the the power of Administrative Access.

I find its best to grant permissions on a per group basis. I usually start with the Default 2003 SVR policies which is Everyone: Allow Read Administrators: Full Access.

NTFS permissions can be granted on a per user basis after that. Moving all of the users to a special OU and then creating, modifying and assigning a GPO to that OU can also be a good way of making sure a user does not have more access that they need.

Hope this helps.

This discussion is closed to new replies.