Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Best practice for system or network administrator accesss

Posted on 2009-07-15
8
Medium Priority
?
431 Views
Last Modified: 2013-12-04
What security access would you typically give a system and network administrator on a windows 2000/2003 server?  Would you grant them overall administrator access?  What is the best practice?  
0
Comment
Question by:jodie888
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 25

Expert Comment

by:Ron Malmstead
ID: 24872745
I give my admins access... "as needed"....

They start out with user level access, but with admin privilages locally on workstations...
0
 
LVL 3

Expert Comment

by:scwoa
ID: 24880696
I agree.   To many places give out Domain admin rights to junior level guys.    And once you give it out, it becomes hard (politically) to take it away.  

It depends on how big you are, a small shop with one or two IT people you may have to give it to them.

Some examples of when you need \ dont need domain admin rights...

If they are adding domain controllers to the domain, fixing trust relationships, , then they need it.

If they are answering help desk ticket calls, and changing printer toner, they don't.   Local admin is fine.  

If they are doing account maintenance, such as resetting passwords, changing names, you can give them account operators permissions.    Along with instructions stating they cant add anyone to the domain admins \schema admins \ enterprise admins \account operators without your permission.  (You can also create restricted groups..)

If they say they want to change the schema, and join the schema admin group, ask what they are doing and why.   Then say no.  :)   Usually schema changes do not happen very often.

If they are an application person, who only knows an application, and doesnt know what AD users and computers is, they dont need it.

Rebooting servers \ working on servers- no, give them local admin rights to the server, or maybe the server ooperators group.
Rebooting Domain controllers - Yes, they need a domain admin account.

If they are cowboys, and change stuff for no reason and without a backout plan, dont give it to them.

If you have a specific case \question of whether they need domain admins or not, please post it...
0
 
LVL 37

Expert Comment

by:bbao
ID: 24882037
basically, if they are TRUSTED REAL administrators, give them the permissions of windows administrators. otherwise, if you are the ACTUAL REAL administrator, give them the permissions JUST satisfied for their role, such as normal users with *extra* rights, or simply the Power Users, even the Power Users with *reduced* rights.

hope it helps,
bbao
0
Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

 
LVL 17

Expert Comment

by:OriNetworks
ID: 24892240
In a domain environment, I usually assign permissions or delegate only on an as needed basis.

For smaller organizations, you may have to assign domain admin or atleast have access to a domain admin account in case the primary admin(you) is not there or something happens.

Any other place, I would stick with the "as needed" and maybe assing as local admin for certain servers if needed.

Common tasks to delegate to someone else:
Create user accounts and possibly group membership(keep in mind this would give them the ability to add their own account to domain admin group)
Reset user passwords
View group policy
Add as local machine admin for regular workstations (install software, etc.)
Join computer to domain
Access to certain network folders(software, logs, etc.)
0
 
LVL 1

Expert Comment

by:DJM2009
ID: 24905809
I would also suggest , depending on what you decide to do , to also monitor ( if you have the tools available ) the addition of users to domain/schema/enterprise admins group.
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 25203194
Remark, splitting 50 points among the experts is useless, so I decided to suggest  paq w/o refund.
0
 

Accepted Solution

by:
ee_auto earned 0 total points
ID: 25229468
Question PAQ'd, 50 points not refunded, and stored in the solution database.
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
Video by: ITPro.TV
In this episode Don builds upon the troubleshooting techniques by demonstrating how to properly monitor a vSphere deployment to detect problems before they occur. He begins the show using tools found within the vSphere suite as ends the show demonst…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question