Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Reducing dman admins

Posted on 2011-09-17
3
Medium Priority
?
303 Views
Last Modified: 2012-08-14
Hi guys we are tasked with trying to reduce the number of domain admins in our network.
Let's say we have A list of 30 users who are members of domain admins.
How could we identify if these users have not performed a task that requires domain admin membership in the past 6 months?
By doing something like this, we could justifying removing these users from the domain admin group.
Thanks everyone.
0
Comment
Question by:Simon336697
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 1000 total points
ID: 36553855
It would be hard to go back in time and figure out everything they have done in 6 months.

What I've done in the past is reach out and ask,  what do you do in your daily job, then figure out why/if they actually need DA rights or can the rights be delegated.


Very worthwhile project, not always easy to reduce, and can get political/personal.

Thanks

Mike
0
 
LVL 24

Assisted Solution

by:Sandeshdubey
Sandeshdubey earned 1000 total points
ID: 36555520
The best practice is to find the number of user who requires domain admin rights for certain activity.
why they require and how many times they required in a month and for what activity?

If the activities are realated to desktop you can right away remove the domain admin rights and add the user to their local desktop administrator group as per requirement.Refer www.globalimaginginc.com/resources/docs/AddingLocalAdministrator.doc

It is not best practise to have n nos of domain admin in the environment.
0
 
LVL 1

Author Closing Comment

by:Simon336697
ID: 36946218
Thanks so much guys sorrry about the delay.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Suggested Courses

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question