Background: We have an Active Directory environment that is in production and we continue to move more machines and servers into it. We do not have direct access to the user objects to move them around like you would normally be able to do. Instead, we can only work with user groups and assign permissions and settings to them and for user configuration we have to use loopback processing.
Our servers, at least right now, are all together in one OU. We have various group policies attached to this OU that provide a stock set of configurations. For example, we have one that contains only computer config items for all server, one that contains user config items for all servers, one that provides local admin rights to the server, and others that function as overrides to the policies provided in those three and are security filtered to the respective server that it needs to override the settings with.
Issue: We have a number of servers that we need to provide additional access to for various user groups outside of the traditional IT staff. For example, we have a server that runs desktop imaging software on it that the Help Desk user group needs to have admin access to and remote desktop as well as the regular IT staff. We have another server that an accounting team needs admin rights and remote desktop rights to as well as the IT staff. We have another server that runs some HVAC software and facilities will need additional access to this one as well as an outside vendor.
The problem that we are having deals with continuning to extend these permissions. It is becoming unmanageable as we add new servers and have new user groups that need permissions. The override the settings with security filtering and group policy precedence is untenable and difficult to troubleshoot. Is there a better way to approach this? How should we setup this environment to allow this?