Solved

Restricting access to remote sites.

Posted on 2011-09-02
8
166 Views
Last Modified: 2012-08-14
We have a site in China which is looked after by an external IT company which provides 'hands-on' support for us when remote access simply won't do.  This site is linked by AD (single Forrest) to our our sites in the UK and I was wondering what is the best was to esnure they can have access to the site in China; but not to the UK sites.  I don't want to restrict them so they can't do their jobs, but they should be able to be an Administrator for the site in China, but not 'meddle' outside of 'their' site.  Any ideas how to implement this?
0
Comment
Question by:icuadmin
8 Comments
 
LVL 14

Expert Comment

by:athomsfere
ID: 36474059
Are the Chinese machines is the same OU?

If not, and you have a OU for China and one for the UK then create a security group for remote access to the China OU by the Chinese security group.
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 36474064
So right now are there domain admins or people in the built in administrators group (on domain controllers) that are based out of china?   If that is the case then you really can't do much.

Have you thought about using a read only domain controller at the China site?  An RODC admin doesn't need to be a domain admin.

You can also use restricted groups to give them admin rights on the local PCs in China.

Thanks

Mike
0
 
LVL 1

Author Comment

by:icuadmin
ID: 36474085
Chinese machines ARE in the same OU.
The Chinese DC is in the same OU as all the other DC's.
The DC in China is based on Windows Server 2003, so we can't make it read only I'm afraid.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 57

Expert Comment

by:Mike Kline
ID: 36474124
So there are Domain Admins in China?
0
 
LVL 1

Author Comment

by:icuadmin
ID: 36474138
They don't.  But we need to give them the right level of access so they can recover the server in the event of a disaster, but not enough access so they can start looking outside of China.
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 36474334
They would need rights to run dcpromo to get the DC back up.  There are articles around that talk about doing that delegation.  I won't post any of them because I haven't tested that scenario so I don't want to post without testing.

Thanks

Mike
0
 
LVL 24

Accepted Solution

by:
Awinish earned 500 total points
ID: 36480889
For promoting or restoring a DC, you need a domain admin & domain admin is everything in single forest/domain. One way to keep check is real time monitoring using SCOM or some other tool & enabling auditing on the DC. Person who wants to restore a DC or promote it requires nothing less than domain admin membership & by default all the domain user can read AD data as all the domain users are member of authenticated users group.


0
 
LVL 1

Author Closing Comment

by:icuadmin
ID: 36521478
Thanks.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question