Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Finetune AD object permission

Posted on 2014-11-07
5
93 Views
Last Modified: 2014-11-10
Our domain Helpdesk group has right such as add users, computers and reset password to AD objects in our domain.

There are certain AD objects (domain security groups) that we would like to restrict the above right only to a few members within the Helpdesk group.

Is it possible?
0
Comment
Question by:nav2567
  • 2
  • 2
5 Comments
 
LVL 12

Accepted Solution

by:
Steven Wells earned 400 total points
ID: 40429894
the best thing is to create a seperate OU for those groups and ensure you delegate permissions separately to that OU. You may have to remove delegation from top level objects to ensure Helpdesk only have rights as needed.
0
 
LVL 13

Assisted Solution

by:Rizzle
Rizzle earned 100 total points
ID: 40430095
Agree with Steve. You would have to create another OU and apply different permissions to ensure no modification of any  accounts can take place. We have this inplace where service and domain admin accounts sit in one OU which only our team have access to which excludes the helpdesk.
0
 

Author Comment

by:nav2567
ID: 40430198
Thanks both.

When I remove delegation, do I just go to the OU's properties>security and remove the Helpdesk group in the "Advance" list, and that's?

Thanks.
0
 
LVL 13

Expert Comment

by:Rizzle
ID: 40430202
Correct.
0
 

Author Closing Comment

by:nav2567
ID: 40433760
Thanks, both.
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A procedure for exporting installed hotfix details of remote computers using powershell
This article runs through the process of deploying a single EXE application selectively to a group of user.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question