Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

What type of access would you gain access to if you are administrator of AD 2003?

Posted on 2004-08-10
4
Medium Priority
?
172 Views
Last Modified: 2010-08-05
Hello,

What type of things you think an administrator should have control over?  For e.g. RDP access, Restore AD objects, FSMO changes, etc...
0
Comment
Question by:mystikal1000
4 Comments
 
LVL 18

Expert Comment

by:John Gates, CISSP
ID: 11768499
Well that is a loaded question?  What is the experience level of the administrator?  That is an important thing to consider.  An experienced administrator should have control of RDP settings following company policies regarding it.  A senior administrator should handle restoration of active directory objects (Because of the many steps involved) FSMO changes would be a senior administrator also. FSMO roles after a domain is established would not be done often.  Does this help?

D
0
 
LVL 1

Author Comment

by:mystikal1000
ID: 11769199
Lets say an experienced SR Administrator that should everything capable of administrating AD.  I just want to see what are some suggestions and views on this matter?
0
 
LVL 5

Expert Comment

by:dgroscost
ID: 11769308
Well, if we're talking an experienced administrator that isn't prone to screwing up things, unless there was a valid reason to only delegate certain authority to his account, I would probably recommend giving him complete access - domain, schema, enterprise, etc.  Now, you shouldn't add his specific user to these groups, instead you should provide him with the domain admininistrator credentials.
0
 
LVL 20

Accepted Solution

by:
What90 earned 2000 total points
ID: 11770401
Depending on how many people on what their skills are you can break the admin roles in to different areas.
Sit down and work out what your company has as admin skills and what needs to be done on a daily/weekly/monthly/yearly basis and that may help pick out certain natural roles for working with AD.

Extending the Schema - say would be a yearly thing and only should be done by the most experienced Admin.
Changing users passwords could be done by the helpdesk or a power user and most likely needs to be done dailt


So leave the Enterprose admins groups as top of the tree - as they can do anything to the system/ad etc - 3rd level or higher support skill sets

you may want to break down the Domain admin roles or level it to 2nd/3rd support guys

Then break down the day to day use of the systems and functions. You may want to give the 2nd level guys full control over  OU's and certain functions, like GPO creation of modifying.

Then break the day to day stuff to 1st level - resetting passwords, add machine/printers etc


Hope that's some help.

Chris
0

Featured Post

Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Despite its rising prevalence in the business world, "the cloud" is still misunderstood. Some companies still believe common misconceptions about lack of security in cloud solutions and many misuses of cloud storage options still occur every day. …

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question