MS Windows Access permissions

Posted on 2014-03-16
Medium Priority
Last Modified: 2014-05-28
If I need to grant users administrator permissions on Windows 2008 but not domain permissions.

The user would be system admin with clearance to install patches, manage the system but not able domain admin?

Question by:ramziabk
  • 3
  • 2
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39932295

"install patches, manage the system" on single system ??
on domain controller ??
LVL 40

Expert Comment

ID: 39932310
On domain Controller this is not possible
If you add user to built-in administrators group, you will grant him permissions to manage entire domain and he can assign himself domain admins, enterprise admins rights as well

On member servers, you can add user to local administrators group so that he can carry required tasks such patch management \ software installation etc on that server only

Not sure what you are looking for exactly
You can have WSUS deployed in network which can take care of patch management and it do not required user to be in local administrators group


Author Comment

ID: 39932488
My objective is to have super users without the domain admin privelage.
The user will be assigned the IT operations role such as creating domain users, joining pc to domain, troublshoot user access etc.

At the same time, the domain admin should not granted to this function.
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

LVL 40

Accepted Solution

Mahesh earned 1500 total points
ID: 39932521
You can add your super user to accounts operator so that they can manage all aspects of users such as creation of new users, adding \ removing from groups, edit their attributes and reset passwords and so on
Also you can make them administrators on client computers so that they can install \ uninstall software's , troubleshoot problems etc

Also you need to grant then delegated access to join machine to domain at domain level and in default domain policy
The setting can be found in Default Domain Policy\Computer Configuration\security settings\user rights assignment

Also one another alternative to accounts operators is to provide them delegated access to Ou containing users so that they can create\manage users effectively

You can use group policy batch scripts \ GP preferences to add your super users to local administrators group on client computers

You will find lots of videos on YouTube regarding delegated access and adding users to local administrators group on workstations through GPO. One is below.


Author Comment

ID: 39968597
whatr about the helpdesk membership? does it suffice
LVL 40

Expert Comment

ID: 39970364
What do you mean by helpdesk membership ?

I don't understand please

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Understanding the various editions available is vital when you decide to purchase Windows Server 2012. You need to have a basic understanding of the features and limitations in each edition in order to make a well-informed decision that best suits …
In this article, we will discuss how you can secure Active Directory using free tools, and how you can choose a safe and secure Active Directory security auditing tool.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question