5

I'm a bit new to AD management, so would appreciate some help in what may be a very simple task.

I've got a domain that manages a bunch of different servers, and I want to grant local administrative rights to some domain users to some of the servers (the development webservers).

I appreciate the group concept, so I imagine I would have to create a group containing the users in question another group containing the computers to grant them access to.

What's the best way of going about this?

2 Answers 2

8

You're on the right track. Now, you would need to create an Organizational Unit in Active Directory to place the servers in question in. Then, you create and link a group policy to that OU that adds the security group that you made into the local administrators group on the server.

5
  • I'm just muddling my way through this. I've created a new Policy Object, do I just add the Servers group to the 'security filtering' section, and then configure the 'Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups' part of the policy to update the local admin group?
    – growse
    Mar 18, 2011 at 15:59
  • That sounds about right. I generally go into "Computer configuration/Policies/Windows Settings/Security Settings/Restricted Groups" and assign them there, but the location you use might work better since it updates the Administrators group instead of mandating a set list of users in the group. I generally don't mess with security filtering and just assign the object to a whole OU, but your way seems a bit more elegant :-)
    – Hyppy
    Mar 18, 2011 at 16:05
  • Thanks - I wanted to do the filtering, as there's other computers I specifically don't want these users having local admin on.
    – growse
    Mar 18, 2011 at 16:07
  • 1
    You should always try to target the GPO to as specific of a group as possible. In general I don't use Domain Computers as a security filtering mechanism, I create a group that shares some naming with the GPO. I also "turn off" the unused section of the GPO i.e. - if it is a computer GPO, turn off the user side so GPO's process faster and there is no accidental settings that get applied.
    – BoxerBucks
    Mar 18, 2011 at 16:39
  • Great comment of BoxerBucks. Try to link group policies to organization units and don't go deeper (computer specific/wmi filtering). That way it'll stay manageable.
    – dSebastien
    May 16, 2012 at 6:24
4

You would create a security group in AD, lets call it "developers". You would then add this group as a member of the local admins group on each of these machines. You could do this manually on each of these machines if there aren't many, or look at using group policy to do so by putting these machines in a separate OU, and applying a policy to do this.

You would then add the users you want to have these rights to this group.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .