Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Creating a Domain Admin like group, WITHOUT Actual Domain admin rights?

Posted on 2010-11-18
4
Medium Priority
?
347 Views
Last Modified: 2012-05-10
Hello,

 I'm in the process of securing our domain, and I've discovered a few "issues" :

1) A bunch of users have Domain Admin accounts that SHOULD NOT.
2) Several accounts that are used for code compilation are set as domain admins.

 So, I don't want to cause problems for people, but I don't see a need for these people to have full domain admin rights.

 Does anybody have information on how to setup a "quasi" domain admin group... ie :

 They can RDP to any server (excluding the DC's(2), and possibly the exchange server, but have basically full read/write permissions to most locations in the network ?

 I've looked a the existing groups in the domain, and from what I understand, there isn't really any difference between administrators group and the domain administrators group (both have full access to domain management).

 The other reason for this, is because by default all domain admin accounts have full access to all mailbox's on our exchange server, and that's a major security risk.

 Any suggestions / ideas are greatly apreciated...

0
Comment
Question by:privasoft
3 Comments
 
LVL 58

Accepted Solution

by:
Pete Long earned 500 total points
ID: 34163905
>>They can RDP to any server (excluding the DC's(2), and possibly the exchange server, but have basically full read/write permissions to most locations in the network


In a roundabout way - first put tham in the backup operators group - that lets them have file read/write access
then create a new security group (code admins or something) then grand THAT group logon access on the RDP connectors of the servers they require access to,
1. Using an admin account open a remote admin session to the server in question.
2. Click Start >Programs >Administrative Tools >Terminal Services Configuration
3. Click Connections
4. In the right hand pane RIGHT CLICK the RDP-TCP connector and select properties
5. On the permissions tab click "ADD"
6. Add your code monkeys group in here and select the appropriate level of access.
0
 
LVL 27

Assisted Solution

by:KenMcF
KenMcF earned 500 total points
ID: 34163918
For the servers you can setup restrices group through GPO. You may not want to give them local admin rights, maybe just remote desk users, that would be something you need to decide. For everything else it will be hard to answer. It will all depend on the application you are using and how your permissions are setup. If you exclusivly assign perms to "Domain Admins" then removing them from the group will remove their accees. If you are using other groups to assing perms then they should not loose the access.

http://www.frickelsoft.net/blog/?p=13
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35171033
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
0

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

581 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question