Administration - allowing staff member Active Directory Access

[speckytecky]

I'm currently trying to allow an Admin Staff member access to Active Directory on our Server 2008 Standard Domain she can get to the log on screen but on entering her details gets the following message:

 

To log on to this remote computer you must be granted the Allow log on through Terminal Services right. By default, members of the Administrator group have this right. If you are not a member of the Administrators group or another group that has this right or if the Administrator group does not have this right you must be granted this right manually.

 

What do I need to change. I clearly don't want to give her full Admin rights.

Edited February 5, 2015 by speckytecky

[Steve21]

Are you wanting AD access or remote desktop?

 

If it's just AD access install the AD toolpack for Windows, and delegate access. If it's RD it'll need to add the user to the remote access group on the server.

 

Steve

[tmcd35]

Log into the machine you want her to be able to RDP to and look at the local security groups. One of them will be for terminal server/remote desktop. Add her AD account to that security group.

[chilbs]

you are best giving them an active directory task pad to the specific ou that you want them to access and delegated permissions.

[Roberto]

I'm currently trying to allow an Admin Staff member access to Active Directory

{...}

What do I need to change. I clearly don't want to give her full Admin rights.

 

Those two statements don't really go together. As others have said, you should give them delegated access to whatever it is they need via remote admin tools on their machine. Don't allow people who are not domain admins and who you don't want to be domain admins to log into a DC interactively.

[fiza]

I'm currently trying to allow an Admin Staff member access to Active Directory on our Server 2008 Standard Domain

 

What exactly will she be doing with the access?

[speckytecky]

I'm off to Hospital for a day or so and want a contingency plan for if I'm not around. I just want to allow her to lock accounts down, add new users and reset passwords. None of the above seems to work when I try it. I was wondering if Delegating Control might be a way forward?

 

What exactly will she be doing with the access?

[fiza]

You want to create an MMC console taskpad view then and only give access to the user account area.

 

https://thwack.solarwinds.com/community/solarwinds-community/geek-speak_tht/blog/2012/12/07/use-custom-taskpad-views-to-delegate-ad-tasks