Windows Forum

Ask something
Discussion Locked

Active directory built-in group security

0 helpful
3 replies

by gdemoura

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

We`re currently using Windows 2000 server and active directory. I would like my local administrators to be able to install program on servers (including DC), administer OUs without being on the built-in Administrators group. Indeed, they can add themselves to the "Domain Admin" group.

How can I prevent that?

3 replies

by nz_justice

You could try this, Make them administrators of the machines individually and remove them from the admin groups.

e.g user1 is just a domain user, but he is an admin of the dc machine, he can log-in as a normal user of the domain but have access and admin rights to install stuff on the dc machine.

by lowlands

These are two very different tasks.
To have them administer specific OU's. Put them in a group and then delegate control over the OU to the group you just created.

It will get alot trickier if you want to give them admin rights on specific DC's. The DC's don't have local groups to add users to.

by bfilmfan

I agree with the other's comments regarding the OU admin.

The easiest answer to the DC issue is to place the folks that need to install software into the Server Operator's group. This group does NOT have default rights to administer domains.

http://technet2.microsoft.com/WindowsServer/en/Library/1631acad-ef34-4f77-9c2e-94a62f8846cf1033.mspx

http://www.microsoft.com/technet/security/topics/networksecurity/sec_ad_admin_groups.mspx

http://www.enterprisenetworkingplanet.com/netos/article.php/623801

This discussion is closed to new replies.