Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the domain, be able to add machines to the domain, but have only limited user rights to the servers.

This account will be used by a person in an end-user tech support kind of role. They should have full access to client machines for installing drivers, applications, etc... but I don't want them on the servers.

While I could probably throw something together myself via policy, it'll probably be messy so I figured I should ask: What's the proper way to go about this?

share|improve this question

4 Answers 4

up vote 11 down vote accepted

We do something similar to this in our remote offices. First, create a group for the psuedo-admins in the domain. In AD, delegate control to the OU's they may need to manage (create/delete accounts, or maybe just reset passwords, or nothing at all).

Then use Group Policy to add your group to the local administrators group on the workstations and servers using Computer\Windows Settings\Security Settings\Restricted Groups. Do not deploy this policy to the Domain Controllers OU or the OUs containing your servers.

This obviously depends on having a AD configured in a manner to separate the client systems from the servers.

share|improve this answer
    
+1 Delegation ftw. –  surfasb Sep 10 '11 at 17:41

Set up a permissions group, make the computers you want him to be able to admin members of that group, and give him full control over things that are in that group.

Pretty straightforward. Active Directory is actually made for that sort of issue. Just create a new group folder, and change the security settings under properties.

share|improve this answer
    
How does he give the members of this group the capability to add and remove workstations from the domain? –  tomjedrz Nov 11 '09 at 17:29
    
@tomjedrz Good call. Didn't see that bit. I don't know...We don't allow people to go mucking around in the domain if they're not full admins. –  Satanicpuppy Nov 11 '09 at 18:06
    
You can delegate [limited] rights to specific OU's to lower level accounts but you may want to prepopulate machine accounts in the appropriate OU to avoid messiness. –  Helvick Nov 11 '09 at 19:01

As we move forward into Active Directory environments where UAC is a standard feature you will also have to take that into account as well.

By default only The local Administrator account and members of Domain Admins get automatic elevation and this is needed for many things (connecting to remote admin shares is one, apparently it's an issue with configuring MSMQ and NLB also, I'm sure there are others) simply placing a new group into the local Administrators account may not be sufficient.

To get around this you have to modify the "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" Security Policy under Local Policies, Local Security Settings and set the value to "No Prompt". Hopefully Microsoft will come up with a more targetted way of doing this in future (or fix the edge cases where the required approval prompt goes AWOL).

share|improve this answer

Try this. It's the easiest way I've found so far: http://technet.microsoft.com/en-us/library/cc756087(v=WS.10).aspx Essentially, right-click on the 'COMPUTERS' folder in AD and select 'Delegate Control'. Follow the wizard. Works in all server versions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.