|
Posted by Steven L Umbach on April 8, 2006, 1:15 pm
Please log in for more thread options That would not work for what you want as it would not mitigate any threat of
the user having administrator powers over the whole domain and all domain
controllers. You can not delegate for instance the ability of a user to
install software, changed NTFS permissions, edit Local Security
Policy/import security templates, or add hardware to a domain controller.
Delegation is used to give non administrators the ability to manage most
Active Directory functions such as edit Group Policy and create/manage non
privileged users and computer accounts. --- Steve
> Thanks for the help.
>
> I'd LIKE to try creating a child OU within the Domain Controllers OU,
> and moving the DC into that, just to see if it would work.
>
> But I it's not a good time to experiment, so I demoted it.
>
> Thanks again!
>
>
>> We have 4 DCs. I want to give full administrative privileges to a user,
>> but only for that one DC. On all other servers I want him to be treated
>> as a standard Domain User.
>>
>> How do I do that? Is it possible?
>>
>> If it's NOT possible (or simple enough) I intend to demote that DC and
>> then make him a local admin.
>>
>> Thanks!
>>
>
>
| 
XML Sitemap