What is the best practice for assigning IT support roles Active Directory administration rights without giving away the "keys to the kingdom"?
Posted on 2011-03-15
Within our 2003 domain I have several IT support specialists that currently have additional domain admin logins. I would like to assign them only the roles they need rather than full domain admin level access. My questions are.
- Friom a security standpoint, what is the best practice?
- Am I limited to the "built in" groups only or can you create your own roles groups?
- Would I benefit from modifying the default domain group policy or using group policy's?