Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a new domain structure we are planning on rolling out in the next few months.

Essentially there is a single top level and forest domain controller "mydomain.lan" and two children "us.mydomain.lan" and "pl.mydomain.lan". We want to configure an administrator account or two at the top level domain that then has full administrator permissions on the sub domains. By default the top level administrator cannot access or login to machines on the sub-domains. Running W2K8R2.


share|improve this question
up vote 2 down vote accepted

If you add the administrator accounts in the parent domain to the "Enterprise Admins" builtin group, they should automatically be members of the "Domain Admins" group in child domains.

share|improve this answer
Once added should they become members of the Domain Admins group after replication? I ask because we tried this but it did not seem to work. I will have to check it again. – Brent Pabst May 10 '10 at 13:52
When you create a child domain, its Domain Admins group automatically includes the Enterprise Admins group of its parent domain. If you add members to the parent domain's Enterprise Admins group later, it may take a while for the change to be detected in the child domain, depending on replication intervals and topology. Admittedly it's been a while since I've had to deal with a parent/child setup, so I might be missing something obvious. – ThatGraemeGuy May 10 '10 at 15:33
OK, The problem however though is that when my Enterprise Admin account attempts to login to a remote computer via Remote Desktop in the child domain, say a Windows 7 machine you end up getting an error: "The connection was denied because the user account is not authorized for remote login" This is true for both accounts we create plus the root-level Administrator account. Any ideas why the permissions to modify the children domains does not include the right to remotely login to the workstations? I can login to the domain controllers however. – Brent Pabst May 10 '10 at 16:06

You should check whether "remote connections are allowed to server on which you want your two accounts get access to. In windows server 2012 R2:

  • Add both users to the Enterprise Admins group (in parent domain)

In the child domain go to control panel "Control Panel\System and Security\System" and:

  • Click "Remote settings" in the left panel
  • Check "Allow remote connections to this computer"

and you are done And in case you want child accounts to access the parent you should set a Trust(a second one) cause Prent-Child trust is a built-in trust when setting up child domain

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.