Rights on a DC

[ericksot]

I have a development group which has a separate DC which we trust. They have a user who logs in to their DC box using our domain's account. Everything is working fine. (BTW we have a NT4 Domain). They would like this user to be able to make changes to the registry on the DC without creating an account for him on the DC or adding him to the Domain Admins group for the domain. Due to the fact it is a DC they cant add him to the local admins group. Any ideas how this can be accomplished. They are using AD and group policies.

Thx

 

[CaffieneNnicotine]

Grant him the log on locally right and give him the appropriate permissions to modify the registry. All Complaints Will Be Routed To /dev/null

 

[donnie4564]

Because you are accessing a DC, the local users and computers are unavailable.

However, Microsoft has made a way to grant very detailed permissions for DC's.

Just go to AD Users and Computers, right click Domain Controllers OU, choose delegate control, add the user or group, then you can follow the custom settings to get to the detailed permissions.