Technician Level Network Access (Set of GPO Settings)

[garethEds]

Afternoon All,

 

Not quite sure where to put this, but we want to create a new level of user called 'Network Technician' but we don't want to give access to everything that the Doman Admin has.

 

So at the start, our apprentice is on a Teacher's account setting. I want to add to this.

 

So... does anyone have a list of GPO settings they put in place that give a reduced level of access to an Apprentice level techie?

 

Many thanks

 

Gareth

[Davit2005]

Delegated access rather than GPO I'd of thought.

 

Create AD group then base delegation on that. Don't make it Domain Admin, use restricted groups on Domain PCs, etc.

Edited December 5, 2023 by Davit2005

[Mako]

Delegated access rather than GPO I'd of thought.

 

Create AD group then base delegation on that. Don't make it Domain Admin, use restricted groups on Domain PCs, etc.

 

This. Operate on the principle of least privilege.

 

Here all IT staff have at least two accounts; a 'day-to-day' account and an 'AD account' to perform tech functions.

 

Day-to-day accounts are standard users, no different from teachers or other users. The only difference is we have less restrictive GPOs which allow us to see more bits of Windows. This does not grant more privileges, but allows us to get to things where we can elevate our privileges or just see more information. We cannot run command-prompt, for example, but we can elevate it as another account, such as the local administrator, to do things.

 

The AD accounts are added to one or more groups in AD, and those groups are delegated privileges according to function; such as Tech Group Modification, Tech User Modification, Tech Reset Passwords, Tech Computer Modification etc. These groups have functions delegated via Delegated Access in AD to one or more OUs based on that need. The AD accounts are only able to be used on nominated workstations that have RSAT tools installed where technicians must elevate their permissions with these accounts. The AD accounts are denied logon rights to all devices except those named in the Authorised Workstations group.

 

We do have separate local admin accounts per-technician but after implementing LAPS, these are being phased out. In any case, any local admin accounts are added to gen-pop workstations only via Restricted Groups in GPO.

 

More privileged IT staff also have a 'server user' and a 'server admin' account.

 

The 'server user' account is also a standard account but it is added to the remote desktop users of servers to allow remote logon. They must then elevate permissions via the 'server admin' account, which is only added to the server's built-in Administrators group - not domain or enterprise admins. Anything requiring Domain Admin privileges goes through a special process. Nobody uses the default domain Administrator account. No accounts used for general administrative functions are added to Domain Admins.

Both these accounts are denied logon rights to all devices, except servers, via GPO.

Edited December 5, 2023 by Mako