Kind of delegating control problem

[Jamie_a]

I`m responsible for 2 sites on one domain and want to give my senior techs certain rights for their site, each site is on its own ou and i`ve delegated the controls I want, I`m just struggling with how i would give them local admin rights on the desktop, I could create a group on each one and add them to that but then that would stop them installing computers themselves. could i do it centrally from our 2k3 server?

[DSapseid]

Computer Config->Windows Settings ->Security Settings-> Local Policies -> Security Options -> "Accounts: Administrator Account Status"

 

Set this up in new group policy and apply it to your users

[jsnetman]

Not sure what you are asking in the post but you can script adding a group to the local administrators group via a machine startup script or batch file, below is batch file method:

 

net localgroup "administrators" "domain\group" /add

[cookie_monster]

You could use a restricted groups policy on each OU to add them as local admins on all stations in the appropriate OU.

 

Using Restricted Groups

 

 

Then grant them the right to add computer to the domain seperatly in Active Directory, this way they can add computers to the domain and will be local admins without the need for domain admin rights.

 

http://support.microsoft.com/kb/251335

 

http://www.lockergnome.com/windows/2005/01/21/giving-a-user-the-ability-to-add-a-computer-to-the-domain/

 

 

.

Edited July 23, 2008 by cookie_monster

[jcollings]

Sorry I must be missing something - why not just give them full admin accounts and trust their proffesionalism not to interfere with each others sites?

[cookie_monster]

I'm reading it as Jamie_a not wanting either user to have domain admin rights.

[FN-GM]

Sorry I must be missing something - why not just give them full admin accounts and trust their proffesionalism not to interfere with each others sites?

 

I agree with this.

 

Z

[cookie_monster]

Err well i disagree how do you know the level of competency of the members of staff, i'm respecting Jamie_a's judgement on this. I wouldn't let just anyone have domain admin rights on my network if they're desktop support then give them local admin rights.

Only people that require domain admin accounts should have them i'd never just hand one out to each member of the team especially anyone that i didn't feel had a very good understanding of active directory.

[jcollings]

Err well i disagree how do you know the level of competency of the members of staff, i'm respecting Jamie_a's judgement on this. I wouldn't let just anyone have domain admin rights on my network if they're desktop support then give them local admin rights.

Only people that require domain admin accounts should have them i'd never just hand one out to each member of the team especially anyone that i didn't feel had a very good understanding of active directory.

 

Each to their own I guess. Got to say if I didn't think I could trust my team with admin accounts they wouldn't be working for me. As you say though, I'm sure Jamie_a knows his staff and I don't know his setup. I know my team would be very ineffective if they didn't have admin rights as so much of what they do depends on it.

[cookie_monster]

It's not a matter of trust it's a matter of competency but i know where you're coming from as school IT teams tend to be quite small but if you have more than 4-5 members of staff they really shouldn't all have DA accounts. Allot of data held on the network just shouldn’t be blanket available to that number of people.

[jcollings]

It's not a matter of trust it's a matter of competency but i know where you're coming from as school IT teams tend to be quite small but if you have more than 4-5 members of staff they really shouldn't all have DA accounts. Allot of data held on the network just shouldn’t be blanket available to that number of people.

 

I guess I meant trust to include cometency as well - again if they aren't competent then they are not working for me

 

My team don't have full access to some things - e.g. SIMS and the Finance system - not even I have a logon for the finance package!

[Sylv3r]

I agree depending on the size of the team, you wouldn't want everybody having acess to everything if it is relatively large.

 

We have a team of myself and two technicians here who both have the same access rights as me bar passwords to a couple of systems (Passwords in safe, incase of emergency etc). When the newest Technician started here last September I restricted his rights and addded to them bit by bit throughout the year as and when I felt he had picked up the skills that I felt justified him gaining more access to the system.