unable to launch ADUC

[dinu99]

Hi Guys,

I've two DC's of 2008 R2 and would like to delegate admin access to few administrators. So, I've granted RDP access to DC Server and delegated permissions on ADUC

users are able to RDP into Servers but, unable to launch ADUC mmc console and able to access the same from different workstation through RSAT Tools. Seems like account privileges to launch consoles.

Error : Prompts UAC to input credentials and says "Logon failure: user has not been granted the requested logon type at this computer"

could anyone please suggest on this

Thanks



[Duke5A]

You should NEVER give console access to your domain controllers for something such as this. Your delegated users should be using RSAT on a separate workstation. If it is a problem that these users don't have an assigned workstation, then setup an intermediary. I have a couple users that had this exact problem so I setup a virtual machine loaded with RSAT, and created a user that could only logon to that particular windows install. The delegated user was only given the exact access it needed to a limited number of organizational units.