Sign in
 
HomeWindows Server “8” Beta20082003LibraryForums
Windows Server TechCenter > Windows Server Forums > Directory Services > Override a admin group User's environment using group policy.

Answered Override a admin group User's environment using group policy.

    •  
      Monday, February 14, 2011 5:50 AM
       
       
      Sign In to Vote
      0
      Sign In to Vote
      Is it possible to add a user to Domain Admins group, grant him unlimited access and restrict him to some limits through group policy?
       

    Answers

    All Replies

    • Monday, February 14, 2011 6:36 AM
       
       
      Sign In to Vote
      0
      Sign In to Vote

      Hi,

      this is not possible and this is not good practice. "Domain Admins" and "Enterprise Administrators" groups should be restricted only to those users who really are on that possition and of course using best practices, you should work on regular account and use secondary logon only if it's necessary :)

      AD has many built-in groups which allow to add users there for specific tasks administration. So, mabe you don't need to place user into "Domain Admins" but only to one or more those groups? Could you tell us what that user should be able to do?

      This Microsoft article covers built-in groups in AD and explains what they do

      http://technet.microsoft.com/en-us/library/cc756898(WS.10).aspx

      Regards, Krzysztof
       
    • Monday, February 14, 2011 6:57 AM
       
       
      Sign In to Vote
      0
      Sign In to Vote

      Hello,

      no, members of enterprise/domain admins group have full control, they are the highest admins in the domain or forest. You can't restrict them as they can revert any configured setting.

      If you don't trust them don't make them admin.

      Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
       
    • Monday, February 14, 2011 8:47 AM
       
       
      Sign In to Vote
      0
      Sign In to Vote

      For single forest/domain, domain admins are everything, they can remove complete AD.

      There is no restricted access for domain admin in a single domain forest apart from schema change.

       

       

      Regards

      Awinish Vishwakarma

      Blog : http://awinish.wordpress.com

      Disclaimer : This posting is provided AS-IS with no warranties or guarantees and confers no rights.

       

       
    • Monday, February 14, 2011 11:55 AM
       
       
      Sign In to Vote
      0
      Sign In to Vote

      You can apply Group Policy settings to Domain Admins (via security group filtering) in the same manner as to any other security group. They will take effect - however, as Meinolf has pointed out, wit a bit of ingenuity, members of Domain Admins would be able to revert these restrictions - so this approach is not recommended (since it's not effective).

      hth
      Marcin

       
    • Monday, February 14, 2011 2:16 PM
       
       Answered
      Sign In to Vote
      0
      Sign In to Vote
      i suggest creating a group and granting permissions or delegating control for whatever resources you want this person to have admin rights to, and make him a member, or a member of the built in groups. that's the standard way when you don't want to give someone full control of a domain.
       
    • Friday, February 18, 2011 5:46 PM
       
       
      Sign In to Vote
      0
      Sign In to Vote
      I want some users to stop/start services, Run some third party softwares without elevation request, and access shares easily.