Server Admin Rights

[kineticnrgynx]

We have contract workers comming in to do some work on a couple of our servers. (Neither of those servers are DC's) I am wanting them to be able to login and be able to administrate ONLY those machines while they are here. Since servers don't really have a local set of users/permissions, I'm planning on doing this all through AD. I've created the user account with admin rights and have restricted the "logon to" rights to just those two servers. This will keep them out of the other servers locally, but I really don't want them to have admin rights and be able to see everything on the network. I was thinking of creating another group they could be a member of, and setting all the other servers on the network to deny for that group. This would keep them out of everything else.

I am wanting them to be able to access all the files on JUST those two machines, and administrate them... But I don't want to have to babysit them at all times.

This is my solution.... But, does anyone have a better solution, or more secure/efficient solution?

 

[hewissa]

If the servers are not DC's then you can assign them Power User rights to the servers. Only create unique local logons for them on the two comps and have them logon locally. That prevents them access to your network, and only allows them access to local files. Hewissa

MCSE, CCNA, CIW

 

[kineticnrgynx]

You can't create local users on servers can you? I was looking and cannot find that.

 

[kineticnrgynx]

Oops, forgot, I can add local users in "Manage" on my server.

 

[wbg34]

When I had a similar situation here I used the second group option and denied access through ntfs on any share that I did not want them to have access to.

 

[kineticnrgynx]

Thanks guys and gals for all your help... I figured it out at the last minute on my own. I assigned local users to the two specified servers using the management console, and assigned them both the same username and pw. That way I could go to either machine, log in and easily browse both machines without having to use extra usernames and pw's since the two match on both machines windows doesn't even prompt for one.