Our sysadmins handle a multitude of tasks on servers and workstations alike. I would like them to be able to administer all servers and roles (DNS, DHCP, Remote Desktop Services) with the exception of changing group membership of domain administrator accounts, and taking ownership of files and folders on our file server. (I don't want them elevating their own accounts).

I've been looking into making them members of the Server Operators group, but I can't seem to find information on whether or not this would provide too much privilege. The other thought was to make them local administrators of the member servers, but this would allow them to change permissions on our file server. (I suppose I could exempt this group from this server).

This is my though process so far:

To manage workstations: Make the sysadmins members of the local administrators group.

To manage servers: Add sysadmins to the following builtin server groups: DnsAdmins Event Log Readers Network Configuration Operators Performance Monitor Users Print Operators Remote Desktop Users

On a side note, Sysadmins would also be members of a 3rd group with delegated access to manage user and computer accounts, and reset passwords.

I appreciate any thoughts, clarification or suggestions.

  • DNSAdmins is not a builtin server group. Server Operators only applies to domain controllers. – Greg Askew Jul 16 '18 at 14:34

A group policy object applied to that server might do what you need. All settings mentioned below are found in the three under Computer Configuration → Policies → Windows Settings → Security Settings.

  • under Local Policies → User Rights Assignment, you can edit who has the right to take ownership of objects. Normally it is the administrators group, but you can create another group, or use an AD group for that.
  • under Restricted Groups, you can define who are the members of the Administrators group. Every time the GPO is synchronized, the members of the group will be overwritten, whatever change has been made locally.

You can then leave the Administrators membership to the people maintaining the server, and rely on the restrictions imposed by group policy (you can also enforce some security logging, for example). Then depending on the server roles you need to manage, group membership in a less powerful group might me enough, but I never checked that part.

  • Thank you for your assistance. I found the option for "Take ownership of files and other objects." I don't see a way to DENY this based on policy. I assume I deny these rights via NTFS permission on the particular folder. I'm just having trouble figuring out how to allow the sysadmin staff rights to manage the server (shutdown, restart, install, start/stop services, etc) but disallow them from changing folder permissions. If I make them local administrators on our file server, then they are part of the administrators group, which would then allow them to take ownership... – user3469469 Jul 18 '18 at 12:11
  • Regarding the Restricted Groups: I've also read its possible to add custom groups to the local administrators group using Computer Configuration\Preferences\Control Panel Settings\Local Users and Groups. Is one way considered better than the other, in terms of best practice and security? Thanks again. – user3469469 Jul 18 '18 at 12:23
  • @user3469469, (a) for the "take ownership of files and other objects": there's no "deny" list for that policy. If you want a user not to be able to do it, it should not be in the list. (b) about restricted groups, you can either set a policy that completely replaces the contents of the administrators group at every GPO synchronization, or you can force some custom groups to be inside administrators. The first variant prevents people from adding what they want there because any change would be reverted. The second one only ensures the presence of your custom groups. – Ale Jul 19 '18 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.