Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Background: We have an Active Directory environment that is in production and we continue to move more machines and servers into it. We do not have direct access to the user objects to move them around like you would normally be able to do. Instead, we can only work with user groups and assign permissions and settings to them and for user configuration we have to use loopback processing.

Our servers, at least right now, are all together in one OU. We have various group policies attached to this OU that provide a stock set of configurations. For example, we have one that contains only computer config items for all server, one that contains user config items for all servers, one that provides local admin rights to the server, and others that function as overrides to the policies provided in those three and are security filtered to the respective server that it needs to override the settings with.

Issue: We have a number of servers that we need to provide additional access to for various user groups outside of the traditional IT staff. For example, we have a server that runs desktop imaging software on it that the Help Desk user group needs to have admin access to and remote desktop as well as the regular IT staff. We have another server that an accounting team needs admin rights and remote desktop rights to as well as the IT staff. We have another server that runs some HVAC software and facilities will need additional access to this one as well as an outside vendor.

The problem that we are having deals with continuning to extend these permissions. It is becoming unmanageable as we add new servers and have new user groups that need permissions. The override the settings with security filtering and group policy precedence is untenable and difficult to troubleshoot. Is there a better way to approach this? How should we setup this environment to allow this?

share|improve this question
If you don't have direct access, I guess this means you aren't the domain administrators? I ask because the obvious solution is to start moving things into different OU's and tidying up your policies but if everything HAS to be in a flat OU then it's always going to messy no matter what you do. Also, what's the Domain Functional Level? – Dan Nov 8 '11 at 16:02
We are delegated domain admins but do not have full control over the domain. We CAN create new OUs and that is an option, I just do not know how to structure them to make them work with the policies, etc. The Domain Functional Level is supposed to be at Server 2008. – John Nov 8 '11 at 16:10

Based on your description, I would suggest organizing by two steps:

  • Create groups containing users along the divisions of roles and department
    • For example: a group each for Accounting Team, Facilities, IT staff
  • Create groups containing computer accounts of the servers, for each type of access you want to grant.
    • For example: IT access to a set of servers, Facilities access to a set of servers

Then, create Group Policy Objects that match each computer account group you created. These GPO's place the relevant user groups into the appropriate local groups (local admin, remote desktop users, etc). Next, change the security filtering for each of these GPO to use the matching computer account group, and assign the GPO to your top level OU.

This way, you can still provide group policies that affect all servers, or follow your OU structure for things like Windows Updates and other settings, while giving you granular control over security access.

If you hire a new IT person: add them to the IT user group, and they'll have access to the proper set of servers. If Facilities needs access to a new server: add the new server's computer account to the computer group called "Facilities Server Access", and any existing Facilities staff will have access as defined by the GPO.

Hopefully that made sense; if it's not clear enough I can edit.

share|improve this answer
@ Jeff - Thanks for the excellent ideas. I was curious, is there a way to accomplish the same thing without having to manage all of the computer groups? Perhaps some type of OU layout that would perform the same thing? The challenge with the computer groups, and I could be wrong, is that policy is applied to the computer object then and not based upon the user. – John Nov 21 '11 at 22:29
The problem with organizing by OU's is that a computer object can only be a member of one of them. Based on your question, you'd have to have an OU that was specifically for every possible combination of permissions across your departments, and place the servers into the right one. Then it becomes very difficult if your requirements change in the future. If we're talking remote desktop and admin permissions, those are computer policies within a GPO, so you'd want them to apply to the computer object, which my answer should solve I think. – Jeff Miles May 14 '12 at 16:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.