4

I am trying to figure out a way to delegate permission to a security group to add domain controllers to a domain. The catch is I do not want to add them to the Domain Admin or Enterprise Admin groups. Has anyone tried this before and what did you do to successfully implement it?

What I am trying to accomplish is this https://technet.microsoft.com/en-us/library/cc773327%28v=ws.10%29.aspx

I am granting all the rights below to a specific security group which I have done. The problem is I do not want these admins to have domain admin rights to add machines, users, and ou's, which is what they get if I add them to the Domain Admins group. I have tried using restricted groups .. Security Delegation, but no matter what, the only way to allow them to add a replica to the domain is by giving them domain admin rights. Perfect world would be .. put the group "installation tasks" in the administrators group for the servers but don't tie that association with the Administrator on the domain... Hope this makes sense.

User must be member of Administrators group on member server being promoted.

The crossRef object under CN=Partitions, CN=Configuration, DC= must be pre-created

Inheritable RP on CN=Servers, CN=, CN=Sites, CN=Configuration, DC=

Inheritable CC on CN=Servers, CN=, CN=Sites, CN=Configuration, DC=

CC on OU=Domain Controllers,DC= to create Computer objects

Full Control on the Computer object for the server that is being promoted

Full Control to “Creator Owner” on CN=, CN=Sites, CN=Configuration, DC=

Extended Right DS-Replication-Get-Changes on CN=Configuration, DC=

Extended Right DS-Replication-Get-Changes on CN=Schema, CN=Configuration, DC=

Extended Right DS-Replication-Get-Changes-All on CN=Configuration, DC=

Extended Right DS-Replication-Get-Changes-All on CN=Schema, CN=Configuration, DC=

Extended Right DS-Replication-Manage-Topology on CN=Configuration, DC=

Extended Right DS-Replication-Manage-Topology on CN=Schema, CN=Configuration, DC=

Extended Right DS-Replication-Monitor-Topology on CN=Configuration, DC=

Extended Right DS-Replication-Monitor-Topology on CN=Schema, CN=Configuration, DC=

Extended Right DS-Replication-Synchronize on CN=Configuration, DC=

Extended Right DS-Replication-Synchronize on CN=Schema, CN=Configuration, DC=

  • This requirement is very unusual. I very much doubt you can add DCs without being a Domain Admin. – Zoredache Apr 29 '15 at 20:25
  • I put a lot more information in the original message. – NobleMan Apr 30 '15 at 1:28
4

This actually is fairly common in larger environments where there may be a separate domain or forest for administrative accounts. In that case, you definitely cannot add them to Domain Admins and you probably don't want everyone in Enterprise Admins.

Paul Williams had a good article documenting the various objects and the permissions required. Unfortunately that link is broken, but you can still view it on the wayback machine.

https://web.archive.org/web/20081006114434/http://www.msresource.net/articles/how_to_delegate_the_ability_to_add_a_domain_controller_to_the_domain_%28using_minimum_permissions%29.html

enter image description here

  • Greg, finally I find someone that does not think I am crazy. That is exactly what I am looking for. Thank you for your time finding this gem of an article! – NobleMan Apr 30 '15 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.