Solved

New Security Group Permission/Rights for Windows AD environment.

Posted on 2016-07-26
5
41 Views
Last Modified: 2016-08-22
I have customer requested to have new security group (a group created by himself with new IT staff) granted with a certain rights to administer the servers and network related tasks.

he will create new group and their role as below:-

1-HelpDesk: Add/Remove User ID and join Domain, network configuration, re-set psw

2-Service Admin Operator: run, start, stop services of all domain servers, install programs, re-set psw, network
configuration, DHCP, DNS...server services

3-Group policy editting: registry editting

4-File Share Group: have right to access to all fileshare and folders

5-Service account group: to group all services accounts
Applications already have its own services account so customer will group it own themself, no change on the permissions
of these account and group


i believe i need to configure at GPO to allow those group with that rights. just wonder if there is any article that i can refer?


thanks
0
Comment
Question by:hell_angel
  • 3
5 Comments
 
LVL 42

Assisted Solution

by:kevinhsieh
kevinhsieh earned 250 total points (awarded by participants)
ID: 41730546
I would look at the built-in groups first. For example, Server Operators, Account Operators, Group Policy Creator Owners.
https://technet.microsoft.com/en-us/library/cc756898(v=ws.10).aspx

I use a new group for full control over NTFS.

I guess you can put all service accounts into a group just so you know what the service accounts are, but you can also just put all service accounts into their own OU.
0
 
LVL 36

Expert Comment

by:Jian An Lim
ID: 41730670
Can you explain what you want to achieve?

How GPO comes to play?
0
 

Author Comment

by:hell_angel
ID: 41730712
Jian An Lim,

I know there a some GPO setting need to change in order to add a security group to have certain rights.

just need some idea where to add those group into the correct policy so they have the right to administer the server..
0
 
LVL 36

Accepted Solution

by:
Jian An Lim earned 250 total points (awarded by participants)
ID: 41732402
hell_angel:
Okay, i think i know what you want.

Instead of mentioning from group point of view, i will focus on features and what to do to enable end user to do so


 Add/Remove User ID and join Domain, re-set psw, Group policy editting
<-- this is AD delegation.
http://windowsitpro.com/active-directory/view-remove-ad-delegated-permissions


network configuration , run, start, stop services of all domain servers, install programs, registry editting
<--  will require local admin rights. you need to use GRoup policy preference to assign this group to all machine that relevant (i.e. if is it workstation, then apply to workstation. If it is domain server, apply to domain server.
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/


have right to access to all fileshare and folders
<-- apply this at the root of fileshare. Of course, users can break the inheritance
0
 
LVL 36

Expert Comment

by:Jian An Lim
ID: 41757592
OP left the question. This is best we have hit the note and come out with solutions
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now