Active Directory question....

[saint_stevo]

In W2k3

 

I give a user 'Administrators' rights and they still have limited accounts, they only seem to have full rights if they are given 'Domain Admin' rights, which obviously isn't an idea situation.

 

Any ideas why?!

[magnet]

Are you talking administrator rights to their local machine?

 

What are you trying to resolve?

[Thedelldays]

isnt it something to do with inheritance rights...?

[exit2]

In W2k3

 

I give a user 'Administrators' rights and they still have limited accounts, they only seem to have full rights if they are given 'Domain Admin' rights, which obviously isn't an idea situation.

 

Any ideas why?!

 

Steve are you doing this at top level of the "site" if so why? You can assign users admin rights on various parts of the ous / containers etc etc. What are actually trying to do? But like you say giving them admin rights is a bad move

[saint_stevo]

yeah certain users need admin rights to do certain things. Have tried adding them to the administrators security group but still get limited rights. Have tried setting up new security groups with admin rights and assign that to an o.unit but still only get limited rights.....

[badgerx16]

It is not a good idea EVER to give a user 'Domain Admin' membership, it is a grouping intended only for fixing things when the network / domain really screws itself up. One problem is that no domain management or security policy / profile can ever apply to a D-A member. Also, some systems, such as CITRIX servers, can get really upset when trying to apply their own profiles to a D-A user.

 

Always work on the 'rule of least privilege', give them only sufficient to do what they need to do; there are, I think, about 20,000 combinations of privilege setting in a W2K domain, so you are sure to find something appropriate.

[saint_stevo]

domain admin seems to be the only way users get local admin.....which certain users require

[badgerx16]

1) How many client PCs, and what O/S ?

 

2) Are any of these articles of use ?.....

 

http://searchwindowsserver.techtarget.com/news/article/0,289142,sid68_gci1065698,00.html

 

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

 

 

http://community.scriptingprovip.com/forums/146958/ShowThread.aspx

 

http://blogs.technet.com/heyscriptingguy/archive/2004/10/08/how-can-i-add-a-domain-user-to-a-local-administrators-group.aspx

[saint_stevo]

so i need to write a script to grant local admin? seems a bit arse about face....

 

500 client P.C's, XP and 2000 in a 2003 environment

[badgerx16]

so i need to write a script to grant local admin? seems a bit arse about face....

 

500 client P.C's, XP and 2000 in a 2003 environment

 

Micro$haft Windoze is never straight forward. As Shane_SFC says, Privilege Manager is a good way to control admin rights, it is one of the things I know we are currently looking into - I will ask a couple of my techies for their advice about other options.

[badgerx16]

We are apparently using the resticted groups approach, applying policies to PC based groups in the AD, and adding 'local administrator' access for privileged user groups to the computer groups as appropriate.

[saint_stevo]

Linky...

 

http://pm.beyondtrust.com/products/PrivilegeManager.aspx

 

Just get the powers above to stump up the cash.

 

Just spent 80k on virtualisation.....

[saint_stevo]

We are apparently using the resticted groups approach, applying policies to PC based groups in the AD, and adding 'local administrator' access for privileged user groups to the computer groups as appropriate.

 

Was hoping to be able to apply rights at user rather than computer level....hmmm

[saint_stevo]

i do. Same as where your bro did....what is beyond trust?

[Mewsta]

Stevo..... Try this, it's how I set permissions for Computers in my domain. Assign the GPO to the container/s with the PC's located......

 

http://windows.stanford.edu/Public/Infrastructure/localgroup.html#Groups

[saint_stevo]

Nice one....i'll give that a go tomorrow

[saint_stevo]

He doesn't....i do