Should I use Restricted Groups for this?

[BrotherJones]

Hello all,
I am working for a group of developers. I have created an OU structure in AD that has all of the developers and their workstations under it. Under the developers OU there is an OU called computers - and underneath computers are two OUs - desktops and servers. I would like to give one of the developers administrative rights to all of the servers under the servers OU, but would like to do this via a policy (so that any other machines added to the servers OU automatically assign that specific developer admin rights to the machine). This developer cannot have domain admin rights and shouldn't have admin rights to any other OU other than the servers OU. From what I have read so far, using the Restricted Groups GPO settings may be able to do this (but haven't figured it out yet). Just wondering if this is the way to go, or should I be looking at another way to solve this?
thanks.

 

[58sniper]

Well, the only caveat with using Restricted Groups is that you understand that the policy will CHANGE the group to match EXACTLY what's in the policy - that includes removing others already in that group.

Just keep that in mind.

Pat Richard, MCSE MCSA:Messaging CNA
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[BrotherJones]

Thanks for the reply Pat. Just curious, is this the proper way to go about accomplishing what I want to do, or is there a more efficient way?

 

[58sniper]

That's probably the way I would do it. I don't think you can get more efficient than automatic!

Pat Richard, MCSE MCSA:Messaging CNA
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[NickFerrar]

Yeah restricted groups is the correct way to do this, although if you're only talking about a couple of servers it would be less hassle to add them to the local admin groups on the servers directly.

 

[BrotherJones]

great, thanks for the responses nick and pat.

 

[terry712]

i assume that none of the servers are dc's ?

if they are then it will not work as the servers shouldnt be moved to another ou as they will only use the defaulr dc policy

if they are non dc's (not sure if member server is still correct term now?) then the use of restricted group is the best method