Local Admin rights to a Domain User

jjanczuk
jjanczuk used Ask the Experts™
on
I need to grant Local Administrator permission to a Domain User.
I've a W2000 server with Active Directory, acting as PDC, and a W2000 server stand alone, included into the domain.

I need that a domain user (DOMAIN/jdoe) get admin permissions to administer just the stand alone W2000 server.



Thanks in advance.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:
Hello,

Connect on the stand alone server as Administrator local and modify the Administrators group on that machine by adding DOMAIN/jdoe to this group.

You do this from right click My Computer, select Manage, select Local Users and Groups, and add the user's Domain Account (DOMAIN/jdoe ) to the local administrators group.

Mishou
Commented:
jjanczuk Mishou is correct but you may want to add a domain\group into the local admin on that machine. This will make future modifications much more simple.

By doing this you simply add users into the group which is already a member of the local admin group which therefore inherits the local admin right.

ie on the domain create domain\WorkstationAdmins and put workstation admins into the local administrators group on the local pc.

Then put domain\jdoe into domain\workstationadmins

this way to change in the future requires simply removing jdoe from the workstation admin groups and no workstation access is required.

Don't add DomainUserGroups to the LocalAdminGroup.

It's a great security-risk, because it gives Your DomainUsers access to all the other workstation using \\computername\c$

And it's both when, and even after You remove him from the DomainGroup:

Making a DomainUser member in 2 hours in one of Your "empty" DomainGroups in LocalAdminGroup, because it's nescessary, makes it possible for that DomainUser to add his own LocalUser member of the DomainAdminsGroup on every W2k-client on Your LAN.

When You removes the DomainUser from the "empty" DomainGroup, he can still use
\\ComputerName\C$ on every W2k-klient on Your LAN.

Many Regards

Jorgen Malmgren
IT-supervisor
Denmark






Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial