Local admin on W2k3 DC

[Guest efx/ShiPon]

Is there a way to make a 'normal' user an administrator (share

creation/removal, backups, network config, etc) of a DC? I added the

user to the Server Operators group but user can't start/stop print

spooler and i don't want to give him domain admin access, i also added

the user to the print operator but couldn't also and since the server

is a DC i can't add him to the local admin group.

 

please advice,

efx

[Guest Lanwench [MVP - Exchange]]

Re: Local admin on W2k3 DC

 

efx/ShiPon <sergio.barrios@gmail.com> wrote:

> Is there a way to make a 'normal' user an administrator (share

> creation/removal, backups, network config, etc) of a DC? I added the

> user to the Server Operators group but user can't start/stop print

> spooler and i don't want to give him domain admin access, i also added

> the user to the print operator but couldn't also and since the server

> is a DC i can't add him to the local admin group.

>

> please advice,

> efx

 

Yep, there is no such thing as a "local" user/group/anything on a DC.

 

You can delegate permissions in AD to a group (or a user, but I prefer a

group) and then set them up with an MMC taskpad so they can perform some

admin tasks from their own computer - you'll need to install the

adminkpak.msi on their PC, though.

 

See http://www.petri.co.il/create_taskpads_for_ad_operations.htm for some

starter help -also

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/actdid1.mspx