[Disease]

I am looking to overhaul things here, currentlt techs log in using the Domain admin account when ever tey want to do anything (I know, I know we should not be doing it), I want to change things to proper best practice and was wondering how you set your tech accounts up, what privileges do you give them, do you use a specific GPO etc.

Thanks.

[tommej]

We used to have a single account all our techs used but with people leaving etc the password had to be changed often and it was hard to keep track of who knew what. It was also impossible to audit, so now all the techs have their own account with no restrictions.

[Edu-IT]

We have one domain administrator account, a system administrator account and then our own individual logins which are just regular staff accounts. On a daily basis we can do everything we need from the staff accounts.

[rad]

We have an admin account and our own individual accounts which also have admin rights.

[finbar3]

what o/s are you using, if you are using windows 2003 r2 create a tech group decide what right's they have.You can then add or take away members when you want too.

[elsiegee40]

I'm on my own, but I have my own Domain Admin account - logging on as Administrator is a last resort.

However, my Domain Admin account is not my day-to-day account... too dangerous, I don't trust myself!

My main account has conventional staff privileges. I do most things from that (including Remote Desktop into the server), only using the Domain Admin account if I have to.

[tom_newton]

We have our own accounts, plus an admin account each. Eg. "bob.smith" and "bobadmin"

[willv28]

Everyone has their own accounts. Of course domain administrator account separate, though most of us have enough rights not to need it. All students/stuff, etc have their own accounts as well. It's pretty simple, we have automated batch scripts that add account for us. We use GPOs made with different restrictions for staff/students.

[fawkers]

Hi fokes

We have a normal staff user account, a <initials>.admin account which has delegated permissions for the jobs that we do (local admin on workstations, servers and delegated permissions to ad, gpmc etc). Only the network manager has an admin account with domain admin privileges.

[Cache]

Here currently I have my own standard user account, a standard domain account which is added to the local admins group on each workstation and then domain admin accounts are only used on the servers.

Part of the system I inherited and seems to work quite well actually.

[ajbritton]

IMHO, best practise is as per Tom_Newton's post.

Each users gets a 'standard' account which can be used to log on to the domain and do basic working tasks (Office, Email, Internet etc).

Any users who perform 'admin' tasks should have an additional user account, also unique to them which is used just these purposes.

This follows the principles of least privilege. Users needing to do 'admin' tasks either log on to a PC with their admin account or (as I do) use RunAs to run an Admin tool with elevated privileges.

The Admin account should also only have the essential permissions. For example, my own 'admin' account has not access to Internet or Email as this would duplicate what I can already do with my normal account.

This way of working is initially burdensome to those used to logging on as a Domain Admin all the time but it's surprising how quickly you get used to it.

[FN-GM]

IT staff have there own account with Domain Admin rights.

The Administrator account everyone uses for server stuff

[Disease]

Thanks for all te replies, it's given me something t work with now. Thanks.

[cookie_monster]

We have a domain admin account that everyone (members of the IT team of course) uses BUT it's only allowed to logon to servers. Each user has an ordinary user account for general use then we have a domain user that we make a member of local administrators on all stations using GPO restricted groups. This account has no access to the servers or shared areas it can only see our software share and a tools folder for troubleshooting.

[RabbieBurns]

All our servers run TS so we each have our own accounts which are domain admin accounts and we each individually log onto servers so all stuff can be accounted / attributed to an individual user.