A Gobal Group that has access to Schema admin

[WhatComputer]

I need to figure out a way to setup a global domain administration group that will allow administrators to be placed in one hierarchy.

Example:Superman.WEb.Com is the forest

Girls.Superman.web.com is the sub domain.

Now I can create a group that supports the sub domain, but when I create a member server I have no Schema and or Enterprise admin rights? Do I have to create groups at each domain level or can I have one Global Group filter down from the Forest Win root directory?

Any assistance would be appreciated.

 

[djtech2k]

If both domains are in the same forest you should be able to handle it on one level. What do you mean by "creating a member server"?

-DJ

 

[WhatComputer]

What I meant was at the domain level security works okay, but once you start to build member servers, only the Domain Admin account of the sub-domain gets placed in the administrators group of the local machine. (Example:Girls.Superman.Web.com) sub-domain has a server now built called (Example:One.Girls.Superman.Web.com)

The member server name "One", but when you try and log on with a Winroot level domain account their is no security access to that server? I have tried to place the Winroot level Enterprise Domain account into the administrators group of the member server and can log in, but with no administration rights to that box?

This may be due to the fact that there is either a security issue with our firewall or because we are currently running in mix-mode, which does not allow Universal group access until Native mode?

 

[WhatComputer]

All set once I set up all domains for 'Native Mode". The Universal groups are doing the job for me. The AD Migration tool is not have bad either from Microsoft as well.

Thanks....