Solved

users need to get remote desktop access rights  to domain controller computer without administrator rights

Posted on 2007-11-22
6
7,389 Views
Last Modified: 2013-11-21
I have single windows 2003 standard in the company.
the server is used as domain controller, software dev and file server.
in the file server each worker has his own folder with security/ sharing  rights just for him (and backup user).
some developers needs access to the server, e.g. to restart IIS, to terminate shared files sessions and so on
i want to give those developers terminal service access but when i add them to the remote desktop group the server does not allow them to log in remotely (they are  member of domain users, remote users)
when i add those developers to administrators group they are able to login through remote desktop but they can also change file server folders security = read whatever they want which i can't allow.

In simple words - i need to give some users the abilty to remotely connect and operate most actions on the server but without the abiltiy to change security rights on some folders (and without the ability to give themselves the right to do so...)

thanks.
0
Comment
Question by:pinkman
6 Comments
 
LVL 31

Expert Comment

by:Cláudio Rodrigues
ID: 20334882
This is what you need.
http://support.microsoft.com/kb/234237/

Applies to both 2000 and 2003 DCs.

Claudio Rodrigues
Microsoft MVP
Windows Server - Terminal Services
0
 

Author Comment

by:pinkman
ID: 20342028
it did not work
when domain user is a member of remote desktop users group and, as pointed in the above link, added to the scurity policy "allow log on locally" - he cannot log through remote desktop to the server that runs the Domain controller.
however the "server operators" builtin group can access through remote desktop without permissions to change security for files and folders it does not have rights on - this solves my concern regarding the file server.
i want to give my developers group the abilty to do all actions in the IIS - no success so far.
they were granted for all operations on the proper services - now they can start and stop the smtp service, ftp and www but fail to restart the IIS service ("IIS Admin Service") and i cannot grant them to view and change web sites. any ideas how to do it?
0
 
LVL 3

Assisted Solution

by:l84work
l84work earned 100 total points
ID: 20345083
You can use this work around.  

Create a .cmd or .bat file with the commands to restart the IISADMIN service using the SC command.
Set up a on-demand "scheduled task" to run the .cmd/.bat file with a saved administrator id/password.

Your devleopers can simply run the task to restart the IISADMIN service.
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 
LVL 30

Accepted Solution

by:
LauraEHunterMVP earned 150 total points
ID: 20347843
Just some food for thought - by allowing non-administrators to TS into a Domain Controller, you are making it fairly trivial for those users (or the next piece of malware that they download to their machine without realizing it) to compromise your DC, as you are granting a sensitive permission (log on locally) to an even more sensitive machine (your domain controller.)

As a security best-practice, I leave my DCs to do nothing but be DCs; if I need to run file & print, IIS, whatever, it goes on another box to avoid situations like the one you're describing.
0
 

Author Closing Comment

by:pinkman
ID: 31410565
to I84work for the creative idea, to LauraEHunterMVP because i took the advice and dedictaed a server just for DC and file server and my developers can go wild now:)
0
 
LVL 1

Expert Comment

by:RedAdvanced
ID: 24147233
I did use this setup in my domain, and I found the first comment the best solution.
Of course I do agree with LauraEHunter about allowing non-admin user to a DC, but as some environments are very small, this still is a option. I allowed the users and setup a policy which is very strict and the users cannot do anything on the DC so there is no harm.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

735 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question