What type of access would you gain access to if you are administrator of AD 2003?

Hello,

What type of things you think an administrator should have control over?  For e.g. RDP access, Restore AD objects, FSMO changes, etc...
LVL 1
mystikal1000Asked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
What90Connect With a Mentor Commented:
Depending on how many people on what their skills are you can break the admin roles in to different areas.
Sit down and work out what your company has as admin skills and what needs to be done on a daily/weekly/monthly/yearly basis and that may help pick out certain natural roles for working with AD.

Extending the Schema - say would be a yearly thing and only should be done by the most experienced Admin.
Changing users passwords could be done by the helpdesk or a power user and most likely needs to be done dailt


So leave the Enterprose admins groups as top of the tree - as they can do anything to the system/ad etc - 3rd level or higher support skill sets

you may want to break down the Domain admin roles or level it to 2nd/3rd support guys

Then break down the day to day use of the systems and functions. You may want to give the 2nd level guys full control over  OU's and certain functions, like GPO creation of modifying.

Then break the day to day stuff to 1st level - resetting passwords, add machine/printers etc


Hope that's some help.

Chris
0
 
John Gates, CISSPSecurity ProfessionalCommented:
Well that is a loaded question?  What is the experience level of the administrator?  That is an important thing to consider.  An experienced administrator should have control of RDP settings following company policies regarding it.  A senior administrator should handle restoration of active directory objects (Because of the many steps involved) FSMO changes would be a senior administrator also. FSMO roles after a domain is established would not be done often.  Does this help?

D
0
 
mystikal1000Author Commented:
Lets say an experienced SR Administrator that should everything capable of administrating AD.  I just want to see what are some suggestions and views on this matter?
0
 
dgroscostCommented:
Well, if we're talking an experienced administrator that isn't prone to screwing up things, unless there was a valid reason to only delegate certain authority to his account, I would probably recommend giving him complete access - domain, schema, enterprise, etc.  Now, you shouldn't add his specific user to these groups, instead you should provide him with the domain admininistrator credentials.
0
All Courses

From novice to tech pro — start learning today.