What is the best practice for assigning IT support roles Active Directory administration rights without giving away the "keys to the kingdom"?

Within our 2003 domain I have several IT support specialists that currently have additional domain admin logins. I would like to assign them only the roles they need rather than full domain admin level access. My questions are.
- Friom a security standpoint, what is the best practice?
- Am I limited to the "built in" groups only or can you create your own roles groups?
- Would I benefit from modifying the default domain group policy or using group policy's?
jffisherAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
NavdeepCommented:
Hi,

You can use delegation on OUs to manage but Junior IT Staff. You can Delegate to Groups [domain local/global groups] based on your requirements and then make users the member of those groups.
So simply adding and removing the users from the groups, you can control permissions to them

For more detailed understanding and how to set up please go through this guide

Best Practices for Delegating Active Directory Administration
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=631747a3-79e1-48fa-9730-dae7c0a1d6d3
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.