Junior Admins

[tom11011]

Looking for tips/advice on allowing for junior admins. We have a few people we would like to remove from domain admins to a more junior level.

Specifically, they would need to be able to create user accounts and add members to groups. They will also need to be able to bring a pc into the domain.

They will not be allowed to manipulate dns or dhcp, or make any changes to GPO's.

Any advice appreciated. We are an all win 2003 domain.

 

[astaylor]

i would just use the delegate control wizard to assign specific permissions on a per user basis either to certain OU's or to the domain, whichever is necessary.

http://www.microsoft.com/technet/pr...ctory/activedirectory/stepbystep/ctrlwiz.mspx

-drew

 

[Sleepsalot]

I think This page tells what you are looking for.

http://www.microsoft.com/technet/security/guidance/networksecurity/sec_ad_admin_groups.mspx

Wayne

Life is a big Roleplaying adventure.

 

[tom11011]

thanks I'll take a look.