Active Directory

[sbruce66]

Hello All,
I have been trying to grant administrative rights to one of our web developers on our domain. I dont want him to have access to the whole domain just 1 web server. I created an Organizational and moved the user as well as the computer into the OU. I delgated authority to him but he is unable to control IIS (account is restricted). Any ID how I can set him up to manage 1 server on our domain with administrative rights. Any help on this would be greatly appreciated. I have been beating my head against the wall.

Scott

 

[MattWray]

Have you tried setting him up as a Local Admin on that machine? Then have him logon locally...

Thanks,

Matt Wray

GFH

http://www.sss-steel.com

 

[sbruce66]

I should beable to do it the way I'm describing, but I try it. How do I set him up to login locally with admin right's. I have never done that. Can you tell me step by step.

Scott

 

[MattWray]

I don't believe you can delegate the stopping and starting of services. He would have to be at the least a Server Operator, which would give him access to ALL servers on the Domain.

Log on using the Local admin account. Go to Control Panel, Users and set up a new Admin account with his credentials. Have him log in and work...

I can't think of any other way to be able to control services on one particular server and no others...

Thanks,

Matt Wray

GFH

http://www.sss-steel.com

 

[kmcferrin]

That's easy to do. If you log into the server that he needs rights to, you can add his domain account to the Local Administrators group. Voilla!

Keep in mind that domain controlelrs will not have any local accounts or groups, so this will only work if the server in question is not a DC.

 

[Ringers]

If you assign a group policy to the OU he belongs to, i believe that you can assign permssions for starting and stopping some services in the MMC for computer and software settings.

 

[clownfish]

Just give him local admin. rights on that server by:

right click on the "my computer icon" go to manage.

expand the local users and group

select the group folder and double click on administrators on the right.

click on add and from the "look in" on the top dropdown select your domain and look for the user you want to add.