Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have setup a child domain and would like to grant users from the Parent Domain the same rights on the child domain that members of the Domain Admins group are granted.

So, our setup looks like this: parent.mycompany.com: Primary domain where all Users exist child.mycompany.com: Child domain used for development

I know that we can not add users from the parent domain to the Domain Admins group in the child domain becuase it is a Global group that can no be changed. Is there a way for me to create a Domain Local or Universal group in the child domain and then grant that group the same rights as the Domain Admins group?

Or any other way that would let me grant a user from the parent domain those rights on the child domain?

Note: All domain controllers are running WS2008 with domain elevated to WS2008 functional level.

Thanks, jon

share|improve this question

1 Answer 1

up vote 0 down vote accepted

You can place the users from the "parent" domain into a global group in the parent domain, then nest that global group into the "Administrators" domain local group in the "child" domain. That will give you the functionality you're looking for (assuming a stock set of AD permissions on the child domain). "Administrators" gets named with the same rights as "Domain Admins" in all the permissions on the AD.

As far as permissions on shares and such that you've created-- that's your problem. >smile<

Edit:

The "BUILTIN\Administrators" group in the child domain does have the same rights to Active Directory as the "Domain Admins" group in the Active Directory. You're not talking about rights to Active Directory in your comment-- you're talking about a default group nesting that gets performed on the Local Users and Groups on member computers. The kind of thing you commented on is what I mean when I said "that's your problem". It's an easy one to fix, too.

This is a job for "Restricted Groups" policy!

So, let's say that you want to modify the behaviour of the local "Administrators" group nesting domain-wide in the child domain.

  • Create and link a GPO at the root of the child domain (actually, link it to a sub-OU with a test computer in it first, then when you know it's working, link it to the root of the domain).
  • In that GPO, open "Computer Settings", then "Windows Settings", "Security Settings", and "Restricted Groups".
  • Right-click "Restricted Groups" and do an "Add Group".
  • Click "Browse" in the "Add Group" dialog, key in "Administrators" (not "Domain Admins" or anything else), and click "Check Name" and "OK". Click "OK" to dismiss the "Add Group" dialog.
  • In the "Administrators Properties" dialog, click the "Add" button at the top, beside the "Members of this Group" list-box.
  • Click "Browse" in the "Add Member" dialog and key in "Domain Admins" and click "Check Name" and "OK". In the "Add Member" dialog, you'll see "CHILDDOMAINNETBIOSNAME\Domain Admins" listed. Click "OK".
  • In the "Administrators Properties" dialog, click the "Add" button at the top, beside the "Members of this Group" list-box again.
  • Click "Browse" in the "Add Member" dialog and key in the name of the global group in the parent domain that you created to hold users who are getting "Administrator" rights in the child domain. Before you click "Check Name", click "Locations" and choose your parent domain in the "Locations" dialog and click "OK". Then click "Check Name" and "OK". In the "Add Member" dialog, you'll see "PARENTDOMAINNETBIOSNAME\Group name you created" listed. Click "OK".

When this GPO applies to computers, their local "Administrators" group will get the groups "CHILDDOMAINNETBIOSNAME\Domain Admins" and "PARENTDOMAINNETBIOSNAME\Group name you created" nested into it automatically.

share|improve this answer
    
I tried this, but the Administrators group in the child domain does not have the same rights as Domain Admins. For example, users in the Administrators group are not members of the local Administrators group on machines in the domain. I can add them manually to each machine, but they aren't there by default... –  Jon Rauschenberger Jul 9 '09 at 14:21
    
Jon: I'm dropping an edit on now. –  Evan Anderson Jul 9 '09 at 14:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.