Creating an Ass't Admin login

[TechVanguard]

In a very simple NDS tree (no OU's) I want to create another administrator account that has all admin rights EXCEPT the ability to change the Admin password (or other Admin properties). I have created other admin logins but don't know how to protect the "chief" admin login. Any help appreciated.

 

[marvhuffaker]

First, create the new admin account, and make him/her a trustee of [root] with full supervisor access.

Then, on the regular admin account, add an Inherited Rights Filter and block everything including the Supervisor option.. (When I say block, uncheck the box so that there is a arrow with a line under it.) You might want to mess with the options, you don't necessarily have to block EVERYTHING. you might want to keep the Browse right.

This actually prevents anyone from accessing properties of it, not just the asst. admin.

Marvin Huffaker MCNE, CNE
Marvin Huffaker Consulting

http://www.redjuju.com

 

[TechVanguard]

While adding the IRF makes sense I was never able to block access to another trustee of [root] having supervisory rights. Back to the books I went as I probably am not understanding something about IRFs.

But in my reading I was reminded that the assignment of trustee rights supercedes existing rights so I could make the "ass't admin" login a trustee of the of the admin login but assign only Read and Compare rights.

This does not have the blanket effect of filtering out access by all other users but it is a small system and I only needed to limit access to one other supervisory user who is a trustee of [root].

Thanks for the response. Even though I am still looking at the IRFs, your comments targeted my reading which quickly led to a working solution.