Solved

Lock down users on one machine using GP. Permit same users more rights on another machine. On same domain. Possible?

Posted on 2014-11-13
8
372 Views
Last Modified: 2014-11-13
hi guys

We have a domain and would like to lock down a group of users to a particular server. However, we need those same users to be granted more rights for installing/configuring on a different server which sits on precisely the same domain.

Can this be done at all? If yes, then how does one do that?

Thanks for your help guys
Yashy
0
Comment
Question by:Yashy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
8 Comments
 
LVL 5

Accepted Solution

by:
A Karelin earned 500 total points
ID: 40439512
Create a group in AD. Add users in this group. Add this group in local admin group on your server where these users can install/configure. I hope these users have rights as domain users and havent elevated rights.

Or you can create GPO for this group that grant more rights through adding in local admin group.
0
 
LVL 1

Author Comment

by:Yashy
ID: 40439522
Sweet man, don't know why I didn't think of that;)

Do Domain policies override local policies?
0
 
LVL 5

Assisted Solution

by:A Karelin
A Karelin earned 500 total points
ID: 40439525
Do Domain policies override local policies?
Yes
http://technet.microsoft.com/en-us/library/cc785665%28v=ws.10%29.aspx
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 
LVL 1

Author Comment

by:Yashy
ID: 40439560
Sadly that didn't work, as the actual domain policy we have takes over the local policy. So adding those users locked down on the domain to the local admin on another server didn't permit them to do anything.
0
 
LVL 5

Expert Comment

by:A Karelin
ID: 40439565
Add this group to local admin group manualy.
0
 
LVL 1

Author Comment

by:Yashy
ID: 40439569
That's what we're doing. The user group is locked down for the domain. But when we add this group to the local administrators group on the server, they can't access anything or do much.
0
 
LVL 5

Expert Comment

by:A Karelin
ID: 40439575
Why did you lock down this group?
0
 
LVL 5

Expert Comment

by:A Karelin
ID: 40439581
1.      Create a new group for users in Active Driectory that you wish to add to servers local administrator group.
Create a new group for your server. The server must be added to this group.

2.      

Create a new group policy object and link it to the desired OU. Make sure that the GPO you are using covers the OU that the server you are wanting to give users local administrative rights over. In Security Filtering you must delete Authenticated Users and add the group for server with the server.

3.      

Navigate within the newly created GPO to Computer Configuration -> Policies -> Windows Settings -> Security Settings --> Restricted Groups

4.      

Right-click the Restricted Groups folder and select "Add Group" to add your new Active Directory group to the Restricted Group. In the Group field, type the name of the newly created Active Directory group and click "OK"

5.      
Add the Restricted Group to the local administrator group
In the Restricted Group Properties windows click "Add" under the section titled "This group is a member of:" Type "Administrators" (without the quotes and yes it is plural), in the Group Membership window and click "OK"

6.      

Once your users receive their updated group policy settings every servers within the OU you specified will have your new Active Directory group as a member of the local administrators group. If you need to force the GPO update on a specific workstation, run "gpupdate /force" in a command window on that workstation.

7.      
Add a user or group of users to the Active Directory Restricted Group
When you are ready, or in a position where you need to provide local server admin rights you can simply add the users or group of users to the Active Directory group that you created for use with Restricted Groups within your Active Directory Management Console.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question