Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a new domain structure we are planning on rolling out in the next few months.

Essentially there is a single top level and forest domain controller "mydomain.lan" and two children "us.mydomain.lan" and "pl.mydomain.lan". We want to configure an administrator account or two at the top level domain that then has full administrator permissions on the sub domains. By default the top level administrator cannot access or login to machines on the sub-domains. Running W2K8R2.

Ideas?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

If you add the administrator accounts in the parent domain to the "Enterprise Admins" builtin group, they should automatically be members of the "Domain Admins" group in child domains.

share|improve this answer
    
Once added should they become members of the Domain Admins group after replication? I ask because we tried this but it did not seem to work. I will have to check it again. –  Brent Pabst May 10 '10 at 13:52
    
When you create a child domain, its Domain Admins group automatically includes the Enterprise Admins group of its parent domain. If you add members to the parent domain's Enterprise Admins group later, it may take a while for the change to be detected in the child domain, depending on replication intervals and topology. Admittedly it's been a while since I've had to deal with a parent/child setup, so I might be missing something obvious. –  ThatGraemeGuy May 10 '10 at 15:33
    
OK, The problem however though is that when my Enterprise Admin account attempts to login to a remote computer via Remote Desktop in the child domain, say a Windows 7 machine you end up getting an error: "The connection was denied because the user account is not authorized for remote login" This is true for both accounts we create plus the root-level Administrator account. Any ideas why the permissions to modify the children domains does not include the right to remotely login to the workstations? I can login to the domain controllers however. –  Brent Pabst May 10 '10 at 16:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.