domain admin rights

Is there anyway i can give a group of users equivalent rights that domain
admins have without them being a member of the Domain Admin groups or any of
the other
built in groups.
--
paperhat

I'm guessing that you'll need to be more detailed in describing what is
it that you need to do. But my guess is that my previous post this
weekend (How to make regular user a default admin for Computers
underhisOU ?) can be helpful to you.


David

paperhat wrote:
> Is there anyway i can give a group of users equivalent rights that domain
> admins have without them being a member of the Domain Admin groups or any of
> the other
> built in groups.

Hello paperhat,

You can delegate a lot of rights, be more specific what you are trying to
achive.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Is there anyway i can give a group of users equivalent rights that
> domain
> admins have without them being a member of the Domain Admin groups or
> any of
> the other
> built in groups.

remove and rejoin computers to domain, change computer name, install software
without having to logon as domain or local admin or using runas. RDP onto
servers. Create shares and assign permissions to shares. That's about it i
think
--
paperhat



"DavidC" wrote:

> I'm guessing that you'll need to be more detailed in describing what is
> it that you need to do. But my guess is that my previous post this
> weekend (How to make regular user a default admin for Computers
> underhisOU ?) can be helpful to you.
>
>
> David
>
> paperhat wrote:
> > Is there anyway i can give a group of users equivalent rights that domain
> > admins have without them being a member of the Domain Admin groups or any of
> > the other
> > built in groups.
>

In general, these tasks fall into two categories - one related to AD
permissions/rights (i.e. applicable to AD objects) and the other by
permissions/rights to resources on computers that these objects represent.

In the first case, refer to
http://www.microsoft.com/technet/pro...p/ctrlwiz.mspx

In the second case, ability to use RDP can be easily granted by adding users
to Remote Desktop Users group, share creation/management is available to
members of Power Users.

There is no simple answer as far as software installation is concerned,
since required level of privileges vary greatly depending on the way the app
installer was designed and areas of file system/registry that are affected
by it...

If you are looking for a quick solution - add users to the local
Administrators on target servers/desktops (you can accomplish this using GP
Restricted Groups) and delegate necessary permissions to Computer objects in
AD...

hth
Marcin

Thanks for the tips. I am now clear on what i have to do to achieve this.
--
paperhat



"Marcin" wrote:

> In general, these tasks fall into two categories - one related to AD
> permissions/rights (i.e. applicable to AD objects) and the other by
> permissions/rights to resources on computers that these objects represent.
>
> In the first case, refer to
> http://www.microsoft.com/technet/pro...p/ctrlwiz.mspx
>
> In the second case, ability to use RDP can be easily granted by adding users
> to Remote Desktop Users group, share creation/management is available to
> members of Power Users.
>
> There is no simple answer as far as software installation is concerned,
> since required level of privileges vary greatly depending on the way the app
> installer was designed and areas of file system/registry that are affected
> by it...
>
> If you are looking for a quick solution - add users to the local
> Administrators on target servers/desktops (you can accomplish this using GP
> Restricted Groups) and delegate necessary permissions to Computer objects in
> AD...
>
> hth
> Marcin
>

also see:
http://blogs.dirteam.com/blogs/jorge...01/05/369.aspx

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"paperhat" <paperhat@discussions.ms.com> wrote in message
news:CBF60A67-98E7-4102-AC79-B44AF18689A2@microsoft.com...
> Is there anyway i can give a group of users equivalent rights that domain
> admins have without them being a member of the Domain Admin groups or any
> of
> the other
> built in groups.
> --
> paperhat
>