I am making some fundamental changes to a Windows Server 2003 / 2008 environment. On the Unix side, my security constraints are simple:
- Users who should have admin rights are in a special group ("wheel" or similar).
- When those users log onto those machines, they still don't have admin rights, until they explicitly execute a command with those admin rights ("sudo command" or "su").
- Even when they do execute the command with "su" (sort of like "runas"), they still need to enter a password: their own.
In this system, I can control who has admin privileges (by group membership), prevent them from accidentally executing something with admin privileges by accident (by requiring "su" or "sudo"), and never reveal a core "Administrator" (i.e. "root") password, since they are asked for their own.
How do I do the equivalent on Windows Server? The options as I see it are:
- Add user to local administrators account: But then everything they do is as admin, risking error.
- Require them to do "runas Administrator": But then they have to know the Administrator password, which I do not want shared around.
Is there any solution wherein I can simultaneously: control who has access by group membership; prevent them from accidentally doing damaging things by requiring a separate password; prevent them from ever knowing the Administrator password?