how to let IT staff admin without danger 1

[ilpadrino]

How can I let my IT staff do basic user administration without risk or error? I want them to be able to add and modify users, but do not want them for instance to add a user then make member of the domain admins group.

 

[WhoKilledKenny]

Just add them to the Account Operators group. By design they can not make changes to accounts that have the same rights or greater. Meaning, they can not add/modify/delete other users with Account Operators permission nor any account with Domain Admin rights.

 

[WhoKilledKenny]

You could also delegate permission allowing certian users the ability to manage objects in the OUs of your choice.

 

[ilpadrino]

So if add to account operators group, that doesn't let me exclude them from controlling, for ex. the accounting groups.

If I want to exclude certain objects I have to take the OU approach. Is there a specific right, Kenny, to assign on the OU, or just full control for the IT staff?


Thanks.

 

[WhoKilledKenny]

What I would do is create a Security Group in AD, something like AccountingUserAdmins. From the accounting OU - right-click and choose Delegate Control. Follow the Wizard to create the desired ACLs.

Then you could create an MMC with just that OU and place it on the desktops of users in the security group. That way they dont have a full view of ADUC. They dont need to see what they cant manage.