Solved

Delegate control of Computers under Active Directory

Posted on 2004-10-15
4
1,540 Views
Last Modified: 2008-12-12
Hi

Is it possible to delegate control of an OU that allows a group to install software and otherwise manage computers in that OU, but not to have any control over user accounts, passwords etc?

We have a native win2k domain and I'm trying to spread our load by allowing a user to install software on all the PC's in his department to save us the job.  I've tried to test by moving a computer account into the appropriate OU then delegated full control of computer objects only to the appropriate user.  It seems to have worked in that he can control that computer account, but he can't install software or do any other admin tasks when logged on to the PC itself.

I presume I've missed a permission somewhere but I'm not sure which one it is.  Can anyone advise please?

I've been generous with the points as a quick answer is required.  Thanks

Cheers
Mart
0
Comment
Question by:strangebloke
  • 2
4 Comments
 
LVL 18

Expert Comment

by:luv2smile
ID: 12318911
He would need to be a local admin on the machines in his department in order to install software.
0
 
LVL 18

Expert Comment

by:luv2smile
ID: 12319080
Allowing him full control in AD to computer objects only gives him the ability to modify the comptuer object properties, not the computer itself in the sense of being able to install software. From this, he could run computer management and view the event viewer, local users/groups, etc. But in order for a user to install software on a comptuer, they need to be a local admin on that computer.
0
 
LVL 3

Accepted Solution

by:
_anom_ earned 500 total points
ID: 12325691
Yeah, I would suggest making a group like "FinanceAdmins" in active directory, then on all of the computers in finance add the FinanceAdmins group to the local administrators group (just using finance as an example).  Then to give people admin on them just add them to that group in AD.
0
 
LVL 1

Expert Comment

by:KhalidHabib
ID: 23163004
_anom_:
good idea, i think you need to add financeadmin on each machine one by one, is there any option to do this thru AD, I mean by applying one policy on AD, all machines should take effects.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now