types of administrator account

[disinfo]

Hello All,

 

 

Im a bit confused with types of administrator;

 

Basically i want my technicians to be able to have read access to the active directory, and be able to reset passwords on acounts

 

They also must be able to add / remove machines from the domain.

 

I've tried account operators, but this doesnt let them do the adding / removing machines, and domain admins seems to give them more or less full control in AD.

 

What would you suggest?

[wesleyw]

 

My original post wasn't worth reading!

 

 

Wes

[ChrisH]

You need to use the delegation of authority wizard. Resetting passwords is easy from that and if you have your machines in an OU of their own then you can delegate them more permissions over that than containers with users in etc.

[wesleyw]

With regards to ChrisH check this website address for a step by step guide:

 

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/activedirectory/stepbystep/ctrlwiz.mspx

 

Wes

[disinfo]

this is great, thanks a lot.

 

One thing though...

 

 

i forgot to mention the domain setup, basically its mostly 2003 but one of the DC's is 2000 (dont snigger)

 

Will it still work?

[wesleyw]

Erm...? I believe it won't I think 2000 cripples the extra functionality of 2003 but I think Chris will know better than I.

 

 

Wes

[NetworkGeezer]

You can have domain controllers running Windows 2000 Server in a Windows 2003 domain. You just need the most recent version of adminpak.msi to be manage it from Windows 2000 or XP.

[Geoff]

Yeah, but you wont be able to raise the domain functional level (and get the extra features) to Windows 2003 Server.

[disinfo]

ok,

 

started to look at this, and it could be the solution...

 

it will work nicely for controlling what they can and cant see in the active directory, however I still cant figure out what permissions to give to allow a non domain admin the ability to join a computer to a domain.

 

I've added my test user to a group called technicains, and using the delegate control wizard i've allowed the test user to be able to create computer accounts (which works) but when i log on to a machine as that test user, the network ID settings are greyed out.

 

What am i doing wrong~?

[Geoff]

Did you also assign them the 'add computers to domain' user right?

[disinfo]

yes, here is what i have done in full

 

 

made a new group "technicians"

made a new user "penguin", who is a standard user not an admin

made a new container "test"

added penguin to technicians

delegated required control over test ou

 

gone to default domain policy, computer configuration, windows settings, security settings, local policies, user rights assignment and given the group technicians "add workstations to domain"

 

penguin can now do the things in the test ou i want, and not the things i dont great.

 

However if penguin logs onto a workstation and goes to the network ID settings, all options are greyed out (even after a forced policy refresh)

 

Basically I need to ask a new question;

 

how to i allow a non administrator user to join a machine to the domain (for example a syspreped out of the box machine)

 

 

Mathew

[BradP.]

The way I thought it worked is that any user account can add up to 10 computers to a domain, if they need to add more they will need to be a member of the account operators group or have permissions delegated to them in AD.

 

I would guess the change name button is greyed out because they are not local administrators. Perhaps you should create a "tech" group with all of your IT staff in the group and add it to the local administrators groups on your PCs (doable through restricted groups in group policy or manually).

 

MS article

[Geoff]

You can't do that with a domain account. You need a local group on the machine with 'add computer to domain' rights.

[disinfo]

that explains it then;

 

so am i right in saying, other than making my technicians member of domain admins (and giving them unwanted access to the AD) there is no way i can let them add remove and chage machine identifications?

[Geoff]

They can if the machine is already on the domain. But it's a bit pointless then.

[disinfo]

so geoff, what would you do;

 

you have an admin you dont exactly want to be looking around AD, but its essential that they can join / disjoin pc's as well as been able to rename them.

 

 

Thanks for help so far by the way

[wesleyw]

Just a quick question when you go in as admin are these still greyed out because I've had a recent batch of machines that this happened to regardless of who was logged on?

 

 

Wes

[BradP.]

The change name right is a local right on the computer, regardless of the computer's domain membership.

[disinfo]

wesley - no not having that trouble.

 

BradP, thanks im going to roll out a new local group i think.

 

Thanks again

[wesleyw]

I think you can linkn the local and domain groups together which should help you with that!

 

It wouldn't even let me in as the lcoal administrator I think soem of the networking configurations had become corrupt!

 

 

Wes

[Geoff]

so geoff, what would you do

 

Create the machine account in AD myself before the technican goes to the machine to add it to the domain.

[Grommit]

so geoff, what would you do

 

Create the machine account in AD myself before the technican goes to the machine to add it to the domain.

 

So whats the point of having a technican then?

 

I am also in the smae situation.. i need Technicians to add remove PC's from the domain, change passwords in the AD Create Accounts in Ranger (need AD rights)

 

Add new PC builds to the Domain etc...