admin right without administrator account

[dibekem]

Good morning

 

I have been asked to create an account for someone who will:

Administer the students’ login in AD, access shares, and setup OS deployment.

I don’t want to give this person the administrator account.

Is there a permissions that does all this but lower that the administrator account?

Our server is Windows Server 2016.

 

Thank you

[FN-GM]

It is possible to do, but you will need to configure this yourself though. EG delegate rights in AD, setup the security permissions on the share etc.

[dibekem]

Thanks.

 

What we don't want is to give him rights to data on staff.

 

I guess I could just give him permissions on all the folder that belongs to students.

 

In AD however you can see both students and staff. How can you give this person right to mess around with students profiles only?

 

He also wants to setup Windows deployment on another server that would push out the image on request.

[FN-GM]

He will have view rights to all AD by default - every user does including non admins. But delegating rights to the student OU mean he only be able to modify student accounts.

 

I don't use WDS (SCCM User here) so I don't know about that.

 

Thanks

[dibekem]

That's great.

 

Just looked in AD, do you mean the Delegate Control option?

[FN-GM]

Thats the one. You might want to find a guide on the internet to find what you want to do. There are hundreds of options!

[dibekem]

Thank you.

 

That solves most of my problems.

 

I just need to figure out the deployment part now.

[sted]

(mdt) deployment basically the user needs access to deploymentshare$ (depending on how automated your system is the boot file/deployment task may have permissions anyway) but other than access to the share they just need the ad permissions to create/edit pc accounts

[Rob_D]

(mdt) deployment basically the user needs access to deploymentshare$ (depending on how automated your system is the boot file/deployment task may have permissions anyway) but other than access to the share they just need the ad permissions to create/edit pc accounts

 

And he'd need the console installed somewhere he can get to.

[sted]

And he'd need the console installed somewhere he can get to.

 

if hes just deploying images does he?

[Rob_D]

if hes just deploying images does he?

Probably not, but if he's just deploying he might not even need access to the deployment share, you don't need admin rights to pixie boot.

I got impression (maybe incorrectly) he'd be maintaining the images ready to go out.

[dibekem]

He would create and deploy images yes.

 

We have an older server with Windows Server 2008 r2 installed on it.

 

He could use that.

[dibekem]

Thank you guys.

 

I managed to setup the old server so he could just used that to setup the whole OS deployment from scratch.