Access to Share a Directory on a Domain Controller

[paintermw]

Our organization has regionalized admins with some sites containing someone designated as part-time LAN support. Regional admins support local LAN admins.... corporate admins support the regional admins.

We are in the process of migrating from NT4 to 2K/AD. We have reduced the number of domain admins from 80 in the NT4 domain (I know, "YUK&quot to a handful in the 2K domain (Yeah!). Basically, the site's LAN support doesn't have domain admin privileges anymore.

Some of our sites are fairly small with files being served from the domain controller instead of having a separate file server. Our Domain Controller Security Policy allows the site's LAN admin group to log into domain controllers locally (amoung other things so we can have them reboot if necessary). The sites that have a DC/FS server usually have a site LAN admin that administers shares. Since they no longer have the access they had in the old domain, they cannot create and administer a shared directory.

Is there a way to give the rights to a specific group that those LAN admins are members of that allows them to create and administer shares on a domain controller without being a Domain Admin, domain local Administrator, or Server Operator? The idea is to allow them to only change shares on their own DC and not other DC's, so I figured Server Operator was out.


Thanx

 

[mark01]

Almost sounds like a Microsoft Certification test question..

 

[scquan]

Use group policy and delegate

 

[tencevaines]

Yup, Group Policies are the way to do it....

You would first have to creat organizational units (OU's) for each group and place that groups servers in there. Then you can create a GP for each OU.

Cheers