Windows Forum

Ask something
Discussion Locked

Security Level for AD?

0 helpful
5 replies

by fitgirl

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Do you need to be a Domain Admin in order to access Active Directory Users and Computers? Is there lower level admin with AD privileges?

OK, here is the story: I am running a Windows 2000 Native mode domain w/ Exch. 2000. We need to classify 1200 emps into 3 email distribution groups. An IT emp has a Win2k Pro PC. I loaded the Adminsitartive tools using Adminpak.msi onto his PC which includes Active Directory Users and Computers.

He is not currently part of the Domain Administrators group and I don't want him to have that power. Is that my only option?

Finally, as my employer continues to reorganize, we will be moving emps from one group to another. Therefore, this is an ongoing project rather than a one-time thing.

Fitgirl

5 replies

by joseph moore

A member of the Account Operators group can open the Users container and make changes to users.
They cannot delete or changes members of the Administrator group, nor can they elevate their own rights.
So, make this temp employee a member of Account Operators group.

hope this helps

by dc1

Create a custom MMC for the user so they only see what you allow them to see. Then using the DElagation of Authority wizard give them the rights that they need to do there job without having to make them more than just a Domain User.

This discussion is closed to new replies.