What kinds of right I need to gain to the local system administrat

Discussion in 'Active Directory' started by PeterP, Dec 1, 2005.

  1. PeterP

    PeterP Guest

    Our company has been setup with both Headquarter and branch offices with
    Server 2003 DCs. We like to gain the control to each branch office system
    administrator to manage their own branch office DC like restart the IIS
    service etc. What is the best way to do? We don’t want the branch office
    administrators to have control on the headquarter DC at all.

    Thanks
     
    PeterP, Dec 1, 2005
    #1
    1. Advertisements

  2. PeterP

    Tony Murray Guest

    Hi Peter

    If the DCs are in the same domain, there is currently no way to provide
    administrator access to a DC without providing Domain Admins privilege.

    You will have to wait for the next version of the Windows Server OS.

    Tony
    www.activedir.org
     
    Tony Murray, Dec 1, 2005
    #2
    1. Advertisements

  3. PeterP

    PeterP Guest

    The branch DCs are the child domain of Headquarter DCs.
     
    PeterP, Dec 1, 2005
    #3
  4. Doesn't matter, it is possible for the admins in any domain in a forest to
    escalate their permissions to enterprise admin if they so desire.

    Even in the next rev of Windows Server currently codenamed Longhorn Server the
    same limitation applies though you can set up a special type of DC called a Read
    Only DC that you can deploy to a site and allow a local admin to have admin
    rights of the machine (but not the AD).

    joe
     
    Joe Richards [MVP], Dec 1, 2005
    #4
  5. PeterP

    Paul Bergson Guest

    Move all unnecessary services off of the DC's and provide the users local
    admin on the new servers.

    You can't manage a single dc within a group of dc's.
    --


    Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Paul Bergson, Dec 1, 2005
    #5
  6. PeterP

    Todd J Heron Guest

    I wonder if they will call it an "RDC". :)
     
    Todd J Heron, Dec 2, 2005
    #6
  7. Currently it is officially called an RODC even though I kept accidently saying
    BDC. ;o)
     
    Joe Richards [MVP], Dec 2, 2005
    #7
  8. Yeah, and *they* didn't take too kindly to that branding <g>
     
    Paul Williams [MVP], Dec 4, 2005
    #8
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.