Solved

What type of access would you gain access to if you are administrator of AD 2003?

Posted on 2004-08-10
4
164 Views
Last Modified: 2010-08-05
Hello,

What type of things you think an administrator should have control over?  For e.g. RDP access, Restore AD objects, FSMO changes, etc...
0
Comment
Question by:mystikal1000
4 Comments
 
LVL 17

Expert Comment

by:John Gates
ID: 11768499
Well that is a loaded question?  What is the experience level of the administrator?  That is an important thing to consider.  An experienced administrator should have control of RDP settings following company policies regarding it.  A senior administrator should handle restoration of active directory objects (Because of the many steps involved) FSMO changes would be a senior administrator also. FSMO roles after a domain is established would not be done often.  Does this help?

D
0
 
LVL 1

Author Comment

by:mystikal1000
ID: 11769199
Lets say an experienced SR Administrator that should everything capable of administrating AD.  I just want to see what are some suggestions and views on this matter?
0
 
LVL 5

Expert Comment

by:dgroscost
ID: 11769308
Well, if we're talking an experienced administrator that isn't prone to screwing up things, unless there was a valid reason to only delegate certain authority to his account, I would probably recommend giving him complete access - domain, schema, enterprise, etc.  Now, you shouldn't add his specific user to these groups, instead you should provide him with the domain admininistrator credentials.
0
 
LVL 20

Accepted Solution

by:
What90 earned 500 total points
ID: 11770401
Depending on how many people on what their skills are you can break the admin roles in to different areas.
Sit down and work out what your company has as admin skills and what needs to be done on a daily/weekly/monthly/yearly basis and that may help pick out certain natural roles for working with AD.

Extending the Schema - say would be a yearly thing and only should be done by the most experienced Admin.
Changing users passwords could be done by the helpdesk or a power user and most likely needs to be done dailt


So leave the Enterprose admins groups as top of the tree - as they can do anything to the system/ad etc - 3rd level or higher support skill sets

you may want to break down the Domain admin roles or level it to 2nd/3rd support guys

Then break down the day to day use of the systems and functions. You may want to give the 2nd level guys full control over  OU's and certain functions, like GPO creation of modifying.

Then break the day to day stuff to 1st level - resetting passwords, add machine/printers etc


Hope that's some help.

Chris
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now