We are running an Active Directory consisting of several different Windows machines (Vista, Windows 7, Windows 10, 2008 R2, 2012 R2, ...). I have to come up with a concept that allows for granular management of local permissions. Currently too many people got full rights on the machines.
I am planing to do the following:
- Administrators (local group on ServerA) <==isMemberOf()== ServerA_Administrators
- Backup Operators (local group on ServerA) <==isMemberOf()== ServerA_Backup Operators
- etc...
Then I would do the same for ServerB, and so on. Later then I would aggregate those AD groups into a bigger ones like this:
- Server_Administrators (members: ServerA_Administrators, ServerB_Administrators, ...)
- Server_Backup Operators (members: ServerA_Backup Operators, ServerB_Backup Operators, ...)
- etc.
That would allow me to control AD-side-wise, which user has local admin-rights. I could give users god-rights on all machines at once and others only one several machines (or only one).
The downside is that i would blow up the AD database, as many new groups are necessary.
Unfortunately I coudn't find any document from Microsoft describing the best practice in the respect of handling local builtin groups in an AD environment.
What would be the best way to achive my goal?