Give user builtin administrator rights on dc, but not ad permissions 1

[nhidalgo]

We run a dc at our remote sites that also have a pervasive DB on them. i need to allow a normail user to login locally, restart services, but have now access to active directory. Can anyone give me a recommed setup. Bultin administrat group rights would be great, by i don't want them to have admin access to AD.

Thanks

 

[58sniper]

Look what mean old Mr. Google says...

http://www.microsoft.com/communitie...7e3-b0d2-b9b7575c17a0&lang=en&cr=US&sloc=&p=1

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[lhuegele]

What you want to do is add them as a local administrator to just that machine.

From the server in question, right-click on the "My Computer" icon and go to manage. When the Computer Management window opens, on the left-hand side, expand the "Local Users and Groups" section. Click on Groups. On the right, double-click on "Administrator". Click the ADD button and add their domain account to this local administrators group. Make sure you enter them as "domain\username" - Click ok and you should be all set.

Good luck,

 

[TechyMcSe2k]

lhuegele, it is a domain controller in question.
It does not use local groups or users. It has to be a domain account with enough rights granted to it.

________________________________________
Achieving a perception of high intelligence level can only be limited by your manipulation skills of the Google algorithm!

 

[TheLad]

You will probably want to add them to either the Domain group Administrators (DC equivalent to the local Administrators group on a member server) or the Domain Group Server Operators, but even that may be too much as the rights will also apply to every DC not just the specific one you want.

Probably best to look further into Snipers link though and delegate the rights.

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[nhidalgo]

thanks for the replies guys, I will test it out tomorrow and report back.

 

[mrdenny]

Keep in mind that Domain Controllers don't have local groups like member servers do.

Denny
MVP
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / SQL 2008 Implementation and Maintenance / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Admin (SQL 2005/2008) / Database Dev (SQL 2005)

My Blog

 

[TheLad]

Although the equivalent groups covering all DCs are stored in the BuiltIn OU in Active Directory.

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[nhidalgo]

Thanks for the replies guys, Seems that the server operator permission does what i need.

Nick