Guest Mally P Posted October 10, 2007 Posted October 10, 2007 Hi All, I work for a support company who provides support for a customer who have offices all over the world. There are no problems with this, the infrastructure works great. However, we only administer the UK branches as the states generally look after everything else. As part of some auditing taking place, they only want admin rights granted to select users, and the account assigned to us is not one of them unless we can prove that we specifically need them. Really all we ever need to do is administer those UK servers and services (DNS, DHCP etc) and not the forest, in which case what rights could we get away with using to do these tasks? Can we use anything less than a domain admin without encountering access issues? Your thoughts are appreciated Thanks in advance
Guest Anthony Posted October 10, 2007 Posted October 10, 2007 Re: Question about admin rights Hi Mally, This is a common problem. You need to agree on the range of tasks you are supposed to perform, then you can sort out access rights for them. There are extremely few you need domain admin rights for, but there are some and you would need to agree who does what. Some tasks have pre-defined roles, like DNS and DHCP administrator, or server backup operator. Some require delegation in AD. Some can't be done, like installing software updates on a DC, promote a new domain controller etc. You can probably do everything you need if they agree to administer the DC's and you get what you need delegated to you, Anthony, http://www.airdesk.co.uk "Mally P" <nomail@thank.you> wrote in message news:eY$Pj90CIHA.4584@TK2MSFTNGP03.phx.gbl... > Hi All, > > I work for a support company who provides support for a customer who have > offices all over the world. There are no problems with this, the > infrastructure works great. However, we only administer the UK branches as > the states generally look after everything else. As part of some auditing > taking place, they only want admin rights granted to select users, and the > account assigned to us is not one of them unless we can prove that we > specifically need them. Really all we ever need to do is administer those > UK servers and services (DNS, DHCP etc) and not the forest, in which case > what rights could we get away with using to do these tasks? Can we use > anything less than a domain admin without encountering access issues? > > Your thoughts are appreciated > > Thanks in advance > >
Guest Mally P Posted October 10, 2007 Posted October 10, 2007 Re: Question about admin rights thanks very much for your reply. I think they are going to have to leave us with dom admin rights! thanks again
Guest Anthony Posted October 10, 2007 Posted October 10, 2007 Re: Question about admin rights Its a pleasure "Mally P" <nomail@thank.you> wrote in message news:Osrudi1CIHA.5856@TK2MSFTNGP04.phx.gbl... > thanks very much for your reply. I think they are going to have to leave > us with dom admin rights! > > thanks again > >
Recommended Posts