How Do I Limit Domain Administrator Logins to a Single Domain Controller from Administrators from other Trusted Domains?

In a Windows 2003 trusted multi-domain environment, how do I go about limiting which domain administrators can login to specific domain controllers in different domains? For example, if I have "Domain Controller 1 on Domain 1", "Domain Controller 2 on Domain 2" and "Domain Controller 3 on Domain 3", how do I restrict logins such that Administrator 1 can only login to Domain Controller 1 on Domain 1? Currently, any administrator can login to any domain controller in any domain by using their login credentials and by selecting the appropriate domain that contains their account. For example, currently Administrator 3 from Domain 3 can login to Domain Controller 1 by entering their login credentials and selecting "Domain 3" as the domain upon logon. How do I limit this so that only Administrator 1 can login to Domain Controller 1 on Domain 1 and Administrator 2 can only login to Domain Controller 2 on Domain 2 and so on?
Who is Participating?
lausengdnConnect With a Mentor Commented:
Make sure the user account for administrator 1 is only in the "Domain Admin" group on Domain1 and not present in the "Domain Admin" group for Domain2 or Domain3.
Then Administrator2 is in the "Domain Admin" group of Domain2 and not in the other 2 domains etc.
Also make sure they are not in the "Enterprise Admins" group for the domains you don't want them to log into.
Modify the Default Domain Controllers Policy GPO in each domain so that only Domain<X>\Domain Admins has been granted the "log on locally" rights within each domain, and not Domain<Y>\Domain Admins and/or Domain<Z>\Domain Admins.  Be sure to test this restriction to ensure that it does not create any application compatibility issues.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.