Solved

REstricting Access to the Server - For administrators

Posted on 2006-11-14
5
229 Views
Last Modified: 2012-03-15
Hi all,

I have a site that has a guy on it that up to now was looking after IT. Due to some difficulties we are taking away his abiliites to work on the server but we still want him to be able to do everything on the pc's such as join domain setup printers install software etc.

So basically I am looking for the best way to stop him logging into the server either at console or remote desktop and also prevent him from managing the server from another machine - but at the same time allow him to manage the pc's without a problem.

Windows 2003 is the OS

Thanks

Michael
0
Comment
Question by:mickinoz2005
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 9

Accepted Solution

by:
trenes earned 84 total points
ID: 17941221
Hi mickinoz2005,

Nice article from Sams.
http://www.samspublishing.com/articles/article.asp?p=98126&seqNum=5&rl=1

I think the best way is to delegate permissions through OU's in your situation. (If no other domains, sites etc)
But read the article and make your own choice.

Cheers!
regards,

Trenes
0
 
LVL 5

Assisted Solution

by:dynamitedotorg
dynamitedotorg earned 83 total points
ID: 17941312
The way I do it is to create a group for workstation admins. This has no particular privileges at all so doesn't allow the user to do anything to AD or a server. However using Group Policy you can automatically make it a member of the local administrators group on each PC thereby giving any member of that group full administrative rights on the PC.

You need to ensure that you only apply that group policy to the machines you want the users to administer, and keep it well away from any that you want to keep them off (e.g. the servers).

The only thing that that won't do is allow him to add machines to the domain. IIRC a normal user can add a certain number of machines anyway, but judicious use of delegation within AD (as outlined above) will sort that out.
0
 
LVL 2

Assisted Solution

by:thelastoftheend
thelastoftheend earned 83 total points
ID: 17942246
I agree with dynamitedotorg - remove this user from any domain admin groups and make him a member of a group which belongs to the local Administrators group on client machines only, applied via Group Policy.

To do this, open your Group Policy and locate the "Restricted Groups" node underneath "Computer Configuration-->Windows Settings-->Security Settings". Right-click and select "Add Group". Type Administrators as the name of the group - this implies the local Administrators group on any computer this is applied to. Click "Add members". Be sure to include "Administrator" and yourdomain\Domain Admins". This policy overwrites any current local Administrators group membership.  Here's a decent description of how to use the policy: http://www.windowsecurity.com/articles/Using-Restricted-Groups.html.

In addition, I would do the following on the server:

1. Browse to "Administrative Tools --> Local Security Settings" (or if its a domain controller, "Administrative Tools-->Domain Controller Security Policy"). Drill down to "Computer Configuration-->Windows Settings-->Security Settings-->Local Policies-->User Rights Assignment".

2. Locate "Deny Logon Locally" and add the user to this right.

3. Locate "Deny Logon through Terminal Services" and add the user to this right.
0

Featured Post

Want Experts Exchange at your fingertips?

With Experts Exchange’s latest app release, you can now experience our most recent features, updates, and the same community interface while on-the-go. Download our latest app release at the Android or Apple stores today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

So you have two Windows Servers and you have a directory/folder/files on one that you'd like to mirror to the other?  You don't really want to deal with DFS or a 3rd party solution like Doubletake. You can use Robocopy from the Windows Server 200…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question