I currently have OU’s in a Windows 2000 mixed mode environment. My OU’s are by location and at each location I have a site administrator.
The Site OU (Washington) holds all of the user accounts for the Washington office.
I have created a local group called _Washington Local Site Administrators and a Global Group called _Washington Global Site Administrators. I have added the people who are site administrators to the Global group. I also made the Global group a member of the Local group.
I then delegate the OU to the Local group and give it ALL access, less Group Policy Objects so they can create users, groups, etc within that OU.
Everything works fine with the exception of ONE thing.
When the site admin clicks on the
Dial-In Tab, they get an “Access Denied” error. They can’t even view the properties.
I need for these site admins to be able to grant/deny/modify a users Dial-In permissions but they can’t do it unless they are members of the Domain Adminsgroup.
Does anyone know of a way that I can accomplish this without making the site admins domain admins?
I have a call into MS and this stumped the tech as well and he is getting back to me tomorrow but I figured I’d throw it out here too.
Thanks,
Brian
