Solved

Creating a Domain Admin like group, WITHOUT Actual Domain admin rights?

Posted on 2010-11-18
4
337 Views
Last Modified: 2012-05-10
Hello,

 I'm in the process of securing our domain, and I've discovered a few "issues" :

1) A bunch of users have Domain Admin accounts that SHOULD NOT.
2) Several accounts that are used for code compilation are set as domain admins.

 So, I don't want to cause problems for people, but I don't see a need for these people to have full domain admin rights.

 Does anybody have information on how to setup a "quasi" domain admin group... ie :

 They can RDP to any server (excluding the DC's(2), and possibly the exchange server, but have basically full read/write permissions to most locations in the network ?

 I've looked a the existing groups in the domain, and from what I understand, there isn't really any difference between administrators group and the domain administrators group (both have full access to domain management).

 The other reason for this, is because by default all domain admin accounts have full access to all mailbox's on our exchange server, and that's a major security risk.

 Any suggestions / ideas are greatly apreciated...

0
Comment
Question by:privasoft
4 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 125 total points
ID: 34163905
>>They can RDP to any server (excluding the DC's(2), and possibly the exchange server, but have basically full read/write permissions to most locations in the network


In a roundabout way - first put tham in the backup operators group - that lets them have file read/write access
then create a new security group (code admins or something) then grand THAT group logon access on the RDP connectors of the servers they require access to,
1. Using an admin account open a remote admin session to the server in question.
2. Click Start >Programs >Administrative Tools >Terminal Services Configuration
3. Click Connections
4. In the right hand pane RIGHT CLICK the RDP-TCP connector and select properties
5. On the permissions tab click "ADD"
6. Add your code monkeys group in here and select the appropriate level of access.
0
 
LVL 27

Assisted Solution

by:KenMcF
KenMcF earned 125 total points
ID: 34163918
For the servers you can setup restrices group through GPO. You may not want to give them local admin rights, maybe just remote desk users, that would be something you need to decide. For everything else it will be hard to answer. It will all depend on the application you are using and how your permissions are setup. If you exclusivly assign perms to "Domain Admins" then removing them from the group will remove their accees. If you are using other groups to assing perms then they should not loose the access.

http://www.frickelsoft.net/blog/?p=13
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35171033
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

[b]Ok so now I will show you how to add a user name to the description at login. [/b] First connect to your DC (Domain Controller / Active Directory Server) SET PERMISSIONS FOR SCRIPT TO UPDATE COMPUTER DESCRIPTION TO USERNAME 1. Open Active …
Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now