AD Restricted Groups - Allowing DC access with Restricted Groups
Hey everyone,
Ive got a little question involving Restricted Groups in a Multi-Domain Forest.
Currently there is (1) W2k Mixed Mode Domains (2) W2k Native Domains, and (1) W2k3 Domain in the forest. All of these domains are being migrated to 1 single parent domain&that being the W2k3 Domain.
Until that is done, I have created special Security Groups in each domain to allow access to the other domains. I do this because there are 3 companies in 17 location in 7 countries. There is a head administrator in each company, but we share responsibilities. For example, I have the awesome job of updating McAfee and Microsoft Patches on 2 of the 3 child companies as well as the new parent company that everyone is migrating to. I need full access in the member servers and DCs.
So I created 2 groups:
GG_ParentCompany_ChildComp
UG_ParentCompany_ChildComp
If a local Domain Admin, such as me, needs access to in other domains, that user is added to the GG_ParentCompany_ChildComp
Its real easy when you think about it&if a domain admin in New Jersey needs access to servers in one of the sibling companies in another country&just add them to the GG_ParentCompany_ChildComp
Problem:
This cross-domain access works on member server in all of the sibling companies...just like we want it to&but the only Domain Controllers that users can logon to with their local domain accounts are in the new Parent Company W2k3 Domain.
For example:
childco\user can log on to ServerX in the domain named ParentDomain &both DCs and Member servers, but childco\user can only log on member servers in the SiblingDomain and not the DCs in the SiblingDomain.
Question:
Is this because of the schema types that are in place??? And is there a way to pull those Domain Admins over to sibling domains and allow them access without having to add the Security Groups from the sibling domains as local accounts on the Domain Controller servers?
Thanks a bunch,
inverted
Ive got a little question involving Restricted Groups in a Multi-Domain Forest.
Currently there is (1) W2k Mixed Mode Domains (2) W2k Native Domains, and (1) W2k3 Domain in the forest. All of these domains are being migrated to 1 single parent domain&that being the W2k3 Domain.
Until that is done, I have created special Security Groups in each domain to allow access to the other domains. I do this because there are 3 companies in 17 location in 7 countries. There is a head administrator in each company, but we share responsibilities. For example, I have the awesome job of updating McAfee and Microsoft Patches on 2 of the 3 child companies as well as the new parent company that everyone is migrating to. I need full access in the member servers and DCs.
So I created 2 groups:
GG_ParentCompany_ChildComp
UG_ParentCompany_ChildComp
If a local Domain Admin, such as me, needs access to in other domains, that user is added to the GG_ParentCompany_ChildComp
Its real easy when you think about it&if a domain admin in New Jersey needs access to servers in one of the sibling companies in another country&just add them to the GG_ParentCompany_ChildComp
Problem:
This cross-domain access works on member server in all of the sibling companies...just like we want it to&but the only Domain Controllers that users can logon to with their local domain accounts are in the new Parent Company W2k3 Domain.
For example:
childco\user can log on to ServerX in the domain named ParentDomain &both DCs and Member servers, but childco\user can only log on member servers in the SiblingDomain and not the DCs in the SiblingDomain.
Question:
Is this because of the schema types that are in place??? And is there a way to pull those Domain Admins over to sibling domains and allow them access without having to add the Security Groups from the sibling domains as local accounts on the Domain Controller servers?
Thanks a bunch,
inverted
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hey Laura,
All this is confusing me again.
This article...especially Table 1, states that it will work...using W2k SP4 or newer...which we are.
(1) http://support.microsoft.com/kb/810076
This article says we can't pull GGs across domains to Restricted Groups:
(2) http://support.microsoft.com/kb/296854
Now that I'm getting these warning messages like you see in article (2) I can't get the cross domain access to work. I wiped everything, Group, GPO, OU, etc off of all 4 domains.
I started fresh with my home domain (W2k Native) and moved a GG over to the Default GPO in my new W2k3 domain. I made that RG a member of various groups to try to get it to not produce a warning message in the application logs. It won't work without making a warning log now...also...I can't log onto member servers like I could before I wiped everything out. I built it back the same way...but it's not working the same.
All this is confusing me again.
This article...especially Table 1, states that it will work...using W2k SP4 or newer...which we are.
(1) http://support.microsoft.com/kb/810076
This article says we can't pull GGs across domains to Restricted Groups:
(2) http://support.microsoft.com/kb/296854
Now that I'm getting these warning messages like you see in article (2) I can't get the cross domain access to work. I wiped everything, Group, GPO, OU, etc off of all 4 domains.
I started fresh with my home domain (W2k Native) and moved a GG over to the Default GPO in my new W2k3 domain. I made that RG a member of various groups to try to get it to not produce a warning message in the application logs. It won't work without making a warning log now...also...I can't log onto member servers like I could before I wiped everything out. I built it back the same way...but it's not working the same.
ASKER
Okay...I got it to work by pulling the Domain Admins group across to the new domain as a Restricted Group...and making it a member of the Administrators in the new domain. I gpupdated the individual servers and it allowed me to use my home local domain account to log on to member servers in the new domain.
Guess it is taking a little longer to update then I thought it should.
Anyway...I removed those groups and RGs because I don't want all of the Domain Admins in my local home domain to work in the new W2k3 domain.
I've recreated my groups and will sit on it for a day to let everything propregate.
Can you think of anyway we can resolve the 5min SceCli Warning Message that all of the servers will have if I roll this thing out?
The Warning Message states:
Source: SceCli
EventID: 1202
Security policies were propagated with warning. 0xd : The data is invalid.
Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".
Thanks again Laura.
Guess it is taking a little longer to update then I thought it should.
Anyway...I removed those groups and RGs because I don't want all of the Domain Admins in my local home domain to work in the new W2k3 domain.
I've recreated my groups and will sit on it for a day to let everything propregate.
Can you think of anyway we can resolve the 5min SceCli Warning Message that all of the servers will have if I roll this thing out?
The Warning Message states:
Source: SceCli
EventID: 1202
Security policies were propagated with warning. 0xd : The data is invalid.
Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".
Thanks again Laura.
I'm not aware of any way to supress those error messages, sorry. It's one of those implementation annoyances of a multi-domain forest (and why I try my darnedest to stick to a single-domain design if I have any say in the matter.)
ASKER
Check this out Laura,
I had been messing around with the RG on the Default Domain Policy and I also tried by creating a GPO and apply it at the site level with the RGs. As we know, this caused the Warning Messages.
I removed those settings and applied directly at the OU with the servers instead of the Site Level or as a setting in the Default GPO, and it stopped making the Warning Messages.
I've got some more playing to do with it...but you've helped once again.
Thanks for everything,
Chris
I had been messing around with the RG on the Default Domain Policy and I also tried by creating a GPO and apply it at the site level with the RGs. As we know, this caused the Warning Messages.
I removed those settings and applied directly at the OU with the servers instead of the Site Level or as a setting in the Default GPO, and it stopped making the Warning Messages.
I've got some more playing to do with it...but you've helped once again.
Thanks for everything,
Chris
ASKER
Actually the Warnings come back when I apply the GPO to the Builtin Domain Controllers OU.
I've done a RSoP on it:
The RG area states:
The policy engine did not attempt to configure the setting and check winlogon.log
winlogon.log states:
Configure Group Membership...
No system mapping was found for CLT\UG_ParentCompany_Child
Group Membership configuration was completed with one or more errors.
I applied the GPO to Domain Controllers OU and I applied the setting inside of the Default Domain Controllers Policy. Same thing either way.
Is this just because it doens't like this sort of thing, or it is protecting the DCs?
I'm really glad this issue is unfolding (o:
I've done a RSoP on it:
The RG area states:
The policy engine did not attempt to configure the setting and check winlogon.log
winlogon.log states:
Configure Group Membership...
No system mapping was found for CLT\UG_ParentCompany_Child
Group Membership configuration was completed with one or more errors.
I applied the GPO to Domain Controllers OU and I applied the setting inside of the Default Domain Controllers Policy. Same thing either way.
Is this just because it doens't like this sort of thing, or it is protecting the DCs?
I'm really glad this issue is unfolding (o:
ASKER
Wait...wait wait wait!!!
If I simply add the UG_ParentCompany_Childcomp
No need for any of this Restricted Groups stuff???
ASKER
Okay...
I've wasted enough time with this...although this is not required in all 4 of our domains, I am going to achieve my goal of allowing Domain Admins from sibling and child domains access to member server and domain controllers by doing the following:
1) Create a GPO with Restricted Goups that pull the administrators from other domains into the target domain by making them members of BUILTIN\Administrators and DOMAIN\Domain Admins.
This will allow RDP logons to Member Server and Workstations OUs.
2) Import the Universal Group from sibling and child domains in the BUILTIN\Administrators group in each target domain.
This will allow RDP logons to Domain Controller servers without using a GPO against the Default Domain Controller GPO that might cause SceCli errors as I described earlier.
I sure hope this helps someone out there.
Chris
I've wasted enough time with this...although this is not required in all 4 of our domains, I am going to achieve my goal of allowing Domain Admins from sibling and child domains access to member server and domain controllers by doing the following:
1) Create a GPO with Restricted Goups that pull the administrators from other domains into the target domain by making them members of BUILTIN\Administrators and DOMAIN\Domain Admins.
This will allow RDP logons to Member Server and Workstations OUs.
2) Import the Universal Group from sibling and child domains in the BUILTIN\Administrators group in each target domain.
This will allow RDP logons to Domain Controller servers without using a GPO against the Default Domain Controller GPO that might cause SceCli errors as I described earlier.
I sure hope this helps someone out there.
Chris
ASKER
When I created the restricted groups, and say I pulled a UG_ParentCompany_ChildComp
I guess I'll still need to add those Universal Groups to the Domain Controllers locally then? But the member servers and workstations will be accessible without having to apply the UG's to the BUILTIN\Administrators.
That will work.
One last thing before I go on my way though is that...pulling these groups around is causing a lot of warning messages in the application logs.
This is exactly my issue here:
http://support.microsoft.com/kb/296854
and warning messages are created every 5 minutes. Is this because I had the Restricted Groups that I created members of both Administrators and Domain Admins?
Should I have it set a certain way to avoid these logs, or is that something we're just going to have to live with. It's kind of scaring the other admins...especially the French one's (o:
Thanks a ton again for your help with this...I'm getting a ton on experience with all of this with your help.
Chris