Recommendations for controlling access with groups

Jason W.

I have a task, where I need to cut down the number of 'domain admin'
rights that are currently issued to a number of people in the IT
department.

I have spoken with our CTO and asked if we could limit that for a
number of reasons. I have been given permission to do so and im in the
process of documenting a process on how to proceed with this.

Basically, running AD 2003 R2 here.
I figure, for the poeple I need to take domain admin privileges away
from, I need to give them some level of access, without giving them
domain admins. What is the best procedure for doing this?

I was thinking of creating a group and using delegation.
However, I was hoping to get some suggestions and feedback here.

The end result is that only 3 people should have domain admin
privileges, while others have limited access, but it does not prevent
them from doing their duty.

I appreciate the suggestions.

Cheers,

JW

Anthony

Delegation in AD will get you started, and is the right thing to do instead
of having many domain admins.
The problem you have to resolve is that domain admin membership gives rights
by default, and when you take it away you have to manually create rights
everywhere they are needed. Its the right thing to do, but its a lot more
work than just delegating in AD.
Anthony
http://www.airdesk.co.uk



"Jason W." <jasonwilliams74@gmail.com> wrote in message
news:1182794403.545547.52890@i38g2000prf.googlegro ups.com...
>I have a task, where I need to cut down the number of 'domain admin'
> rights that are currently issued to a number of people in the IT
> department.
>
> I have spoken with our CTO and asked if we could limit that for a
> number of reasons. I have been given permission to do so and im in the
> process of documenting a process on how to proceed with this.
>
> Basically, running AD 2003 R2 here.
> I figure, for the poeple I need to take domain admin privileges away
> from, I need to give them some level of access, without giving them
> domain admins. What is the best procedure for doing this?
>
> I was thinking of creating a group and using delegation.
> However, I was hoping to get some suggestions and feedback here.
>
> The end result is that only 3 people should have domain admin
> privileges, while others have limited access, but it does not prevent
> them from doing their duty.
>
> I appreciate the suggestions.
>
> Cheers,
>
> JW
>

Jason W.

Thanks Anthony.
That is sort of what I thought. Start with delegation and work my way
forward.

Thanks.

Anthony

Good luck!
"Jason W." <jasonwilliams74@gmail.com> wrote in message
news:1182799655.896881.14080@z28g2000prd.googlegro ups.com...
> Thanks Anthony.
> That is sort of what I thought. Start with delegation and work my way
> forward.
>
> Thanks.
>