Windows Forum

Ask something
Discussion Locked

Local NT Administration

0 helpful
4 replies

by mtaylor

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My shop is running Windows NT 4 SP6a in a single domain configuration. We have several remote locations running a single BDC at each site. My goal is to allow an admin at each of these sites to have control over software installs and light admin responsibilities without being able to make changes to servers outside of their site. I know Windows 2000 AD is the way to go but we are not there yet. Does anyone know how I can better lockdown a "local admin" account? Which persmissions should be set?
Thank you in advance for your help.
Mark

4 replies

by michael_13

OK, step one, realise that you cannot have a LOCAL ADMINISTRATOR account on a domain controller, only on a workstation or a stand-alone server.

Two, by setting up the network with BDC's at your remote sites you have basically created a situation where by if you place a user in the Administrators Group on the domain they will be able to administer the entire network and not just that BDC.

My Idea would be as follows, and I must say it is Theoretical and I haven't tried it myself. I would try editing the policies for the user in the domain user manager. Add the user to allow him to perform certain tasks (for example, Change the system time or perform back-ups). This may still allow him certain privieges on ther network but will at least still not make him an administrator.

by mtaylor

Thanks for you help. I do realize the first two points you made. That is the basis for my question. I agree with you on editing the users persmissions but it hasn't worked as I expected. I'm sure I am simply not choosing the correct grouping of persmissions.

by bluhippo

The points made in the earlier mail are valid but If your other admins need access to update and add software that is server based try giving them LOCAL admin to the server in their area with local log on rights. Then they will be able to logon locally and perform their duties. When they add software they simply give domain users access. Also should they change or update User information on the local system it will not immediately affect the PDC files until there is a file Replication function.You should have the Replication files set to push to the PDC at one time then later the PDC will push out master file changes to all of the BDC's. I have done this exact thing before and it works. And they never had access to any domain servers or files I did not want them to have.

by mtaylor

I failed to mention is it also important these admins at each remote site do not have the ability to add, delete or change user info via
User Manager.

This discussion is closed to new replies.