on an Active Directory domain D1, I'm creating specific groups to delegate some tasks. One of this specific groups is just member of "Domain Administrators" to give people all management powers.
IT administrator accounts will then be member of the specific group depending of the need. These people need to administer multiple AD domains (D2, D3...), so I thought about the possibility to habilitate accounts from D1 on D2, D3...
I managed to make these habilitations for all delegation groups, except for Domain Administrators. This group in D2 or D3 is a "global" group and I can't make a universal group from another domain a member of it.
I know it's dependent of this idea of groups scope in Active Directory (see http://technet.microsoft.com/en-us/library/cc776499%28v=ws.10%29.aspx) but I wonder if someone has found a workaround to this problem.
update So, it's not posible, but using "BUILTIN\Administrators" and GPO/GPP, can I give these accounts the same power as "Domain Administrators"? or will they always have tasks that only a domain administrator could do?