Senior Administrators and Junior Administrators

Discussion in 'Windows Small Business Server' started by Magnetoram, Jun 17, 2009.

  1. Magnetoram

    Magnetoram Guest

    Is there a way to have 2 levels of Administrator access to the domain. I
    would like to have senior admins have Full Permissions and junior admins
    with levels that restrict them from locking out the senior admins or changing
    primary passwords
     
    Magnetoram, Jun 17, 2009
    #1
    1. Advertisements

  2. Magnetoram

    Magnetoram Guest

    Thanks for the post, in your opinion does a member of the server operators
    group have enough priveledge to perform the duties of an admin without having
    access to changing the Root Administrators Password?
     
    Magnetoram, Jun 17, 2009
    #2
    1. Advertisements

  3. Magnetoram

    kj [SBS MVP] Guest

    As Cris replied, you can not effectively restrict an admin. However, you may
    take a lesser account and delegate permissions to perform limited functions
    on OU's and object in AD. So, you could perhaps delegate a group to have
    password reset capability to an OU structure. You can also delegate other
    permissions to them as well depending upon your needs.

    ...but once you make them an admin, trying to deny them abilities is not
    effective.
     
    kj [SBS MVP], Jun 17, 2009
    #3
  4. Magnetoram

    kj [SBS MVP] Guest

    You need to define the tasks you want your "junior" admin to perform and
    then it can be determined how (and if) you can give them only those
    permissions without makeing them a full administrator.

     
    kj [SBS MVP], Jun 17, 2009
    #4
  5. You can delegate tasks in AD - including password changes, etc - to specific
    OUs. Then set up an MMC taskpad on any PC running the adminpak tools. This
    isn't too tough to do if you're experienced with this stuff, but you have to
    be careful about it.
     
    Lanwench [MVP - Exchange], Jun 18, 2009
    #5
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.