Server Administration: Local Admin vs Domain Admin 1

[watergapnomad]

When administering a server (let's say a file server), is it best practice to do so via the server's local administer account, or with an account that has domain admin privileges?

I'm trying to figure out if there is a reason to use one over the other, or if they can be used interchangeably. For instance, when setting up shared folders on a file server, should this be done with the server's local admin account or as a domain admin?

Thanks

 

[Davetoo]

You should use a domain admin account so that you have access to ADUC to assign rights.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[watergapnomad]

Thanks for the info.

But back to my example of setting up network shares on a file server, is it best to do this with the server's local admin account or logged in as a domain admin?

 

[adrianvasile]

I don't think that a local Admin account will let you do it.

 

[Davetoo]

Um, I answered your question...you need to use a domain admin account. What part of that confused you?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[Zelandakh]

If you want to create a network share, it needs to be available to users on the network. Therefore you need to access Active Directory to pick up the groups to share the network share to.

This means you need to use a domain admin account, not a local one.

This is what Dave was saying.

 

[watergapnomad]

Um, I answered your question...you need to use a domain admin account. What part of that confused you? "

Sorry, I was still waking up - brain hiccup.

Zelandakh - thanks for clearing that up for me.

 

[Davetoo]

...hate when that happens... ;-)

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[Zelandakh]

what? Waking up?

 

[watergapnomad]

OK, so if I go ahead and create shares using a domain admin account, does that account then have ownership of the share (and all subfolders) by default? Would the local admin account also have ownership?

 

[Davetoo]

If you're working on a domain, then ignore any local accounts and use only domain accounts.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[watergapnomad]

OK, one more question.

We recently created a new domain for our company. We still have the old domain running, but it will be done away with for good in the next couple of months.

At that time, when I am only using the domain admin account for the new domain, will I need to have this account take ownership of all of the shares that had originally been setup using the old domain admin account?

 

[Zelandakh]

Yes.