Solved

Creating a Domain Admin like group, WITHOUT Actual Domain admin rights?

Posted on 2010-11-18
4
340 Views
Last Modified: 2012-05-10
Hello,

 I'm in the process of securing our domain, and I've discovered a few "issues" :

1) A bunch of users have Domain Admin accounts that SHOULD NOT.
2) Several accounts that are used for code compilation are set as domain admins.

 So, I don't want to cause problems for people, but I don't see a need for these people to have full domain admin rights.

 Does anybody have information on how to setup a "quasi" domain admin group... ie :

 They can RDP to any server (excluding the DC's(2), and possibly the exchange server, but have basically full read/write permissions to most locations in the network ?

 I've looked a the existing groups in the domain, and from what I understand, there isn't really any difference between administrators group and the domain administrators group (both have full access to domain management).

 The other reason for this, is because by default all domain admin accounts have full access to all mailbox's on our exchange server, and that's a major security risk.

 Any suggestions / ideas are greatly apreciated...

0
Comment
Question by:privasoft
4 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 125 total points
ID: 34163905
>>They can RDP to any server (excluding the DC's(2), and possibly the exchange server, but have basically full read/write permissions to most locations in the network


In a roundabout way - first put tham in the backup operators group - that lets them have file read/write access
then create a new security group (code admins or something) then grand THAT group logon access on the RDP connectors of the servers they require access to,
1. Using an admin account open a remote admin session to the server in question.
2. Click Start >Programs >Administrative Tools >Terminal Services Configuration
3. Click Connections
4. In the right hand pane RIGHT CLICK the RDP-TCP connector and select properties
5. On the permissions tab click "ADD"
6. Add your code monkeys group in here and select the appropriate level of access.
0
 
LVL 27

Assisted Solution

by:KenMcF
KenMcF earned 125 total points
ID: 34163918
For the servers you can setup restrices group through GPO. You may not want to give them local admin rights, maybe just remote desk users, that would be something you need to decide. For everything else it will be hard to answer. It will all depend on the application you are using and how your permissions are setup. If you exclusivly assign perms to "Domain Admins" then removing them from the group will remove their accees. If you are using other groups to assing perms then they should not loose the access.

http://www.frickelsoft.net/blog/?p=13
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35171033
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question