Active Directory Admin privileges

Active Directory Admin privileges
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Active Directory Admin privileges Dave 04-28-2006
Posted by =?Utf-8?B?RGF2ZQ==?= on April 28, 2006, 8:59 am
If you were  Registered and logged in, you could reply and use other advanced thread options
We are a company with 7 remote campuses, each with their own on-site IT
person. Mainly these people do things like desktop support, set up file
shares and manage thier campuses users, computers and local servers (DC's).

Previously, each campus was their own child domain, so each one could be a
domain admin, and not have to worry about them having access to sensitve
material back at the corporate HQ. However, we recently collapsed all those
child domains into the parent domain (easier management of resources and
people from the HQ).

Since the collapse, all the problems with management due to the child
domains went away, but the sole nagging problems is that hte local campus
admins no longer have rights to manage their users or servers. Is there a
suggested template for something like this, or third party software or
something that would help me figure out how to set permissions for these
folks?

Any suggestions welcome.

Posted by Roger Abell [MVP] on April 28, 2006, 9:20 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I do not know about a "template", and things quickly get quite
situational anyway, but in general what you need to look at is
using delegation. There are a few pre-supplied choices in the
delegation of control wizard and other delegations that can be
accomplished by drill into the details. I would suggest that you
define a group for each delegation that you make, as otherwise
answering the question "what is delegated over what and to whom"
is not simple (ex. use a naming convention for your groups that
assist you in answering that question and delegate to the group).

Now, pretty much everything you mentioned can be done with
delegation, for example at the OU root for remote site A, if the
computers and users of that remote site are somewhere within
that OU structure.

Where you will have difficulties is with management of the DCs.
Granting admin or server operator to make changes to the DCs
would grant that ability on all DCs. What you likely need to do
is inventory all actions that need to be supported, and then for
each devise a way to get these done, whether centrally under
control by the domain admins or with short-term enabled accts
and time coordinated actions by person at remote, or . . .

> We are a company with 7 remote campuses, each with their own on-site IT
> person. Mainly these people do things like desktop support, set up file
> shares and manage thier campuses users, computers and local servers
> (DC's).
>
> Previously, each campus was their own child domain, so each one could be a
> domain admin, and not have to worry about them having access to sensitve
> material back at the corporate HQ. However, we recently collapsed all
> those
> child domains into the parent domain (easier management of resources and
> people from the HQ).
>
> Since the collapse, all the problems with management due to the child
> domains went away, but the sole nagging problems is that hte local campus
> admins no longer have rights to manage their users or servers. Is there a
> suggested template for something like this, or third party software or
> something that would help me figure out how to set permissions for these
> folks?
>
> Any suggestions welcome.



Posted by Joe Richards [MVP] on April 28, 2006, 10:10 am
If you were  Registered and logged in, you could reply and use other advanced thread options
To add onto Roger's excellent response, you weren't as safe as you think you
were with the child domains and protecting your HQ. You just didn't understand
how Windows works. Had a child DA wanted to take over your HQ domain it wouldn't
have been a lot of work for them to do so. The domain is not a security boundary
in an AD forest.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm



Roger Abell [MVP] wrote:
> I do not know about a "template", and things quickly get quite
> situational anyway, but in general what you need to look at is
> using delegation. There are a few pre-supplied choices in the
> delegation of control wizard and other delegations that can be
> accomplished by drill into the details. I would suggest that you
> define a group for each delegation that you make, as otherwise
> answering the question "what is delegated over what and to whom"
> is not simple (ex. use a naming convention for your groups that
> assist you in answering that question and delegate to the group).
>
> Now, pretty much everything you mentioned can be done with
> delegation, for example at the OU root for remote site A, if the
> computers and users of that remote site are somewhere within
> that OU structure.
>
> Where you will have difficulties is with management of the DCs.
> Granting admin or server operator to make changes to the DCs
> would grant that ability on all DCs. What you likely need to do
> is inventory all actions that need to be supported, and then for
> each devise a way to get these done, whether centrally under
> control by the domain admins or with short-term enabled accts
> and time coordinated actions by person at remote, or . . .
>
>> We are a company with 7 remote campuses, each with their own on-site IT
>> person. Mainly these people do things like desktop support, set up file
>> shares and manage thier campuses users, computers and local servers
>> (DC's).
>>
>> Previously, each campus was their own child domain, so each one could be a
>> domain admin, and not have to worry about them having access to sensitve
>> material back at the corporate HQ. However, we recently collapsed all
>> those
>> child domains into the parent domain (easier management of resources and
>> people from the HQ).
>>
>> Since the collapse, all the problems with management due to the child
>> domains went away, but the sole nagging problems is that hte local campus
>> admins no longer have rights to manage their users or servers. Is there a
>> suggested template for something like this, or third party software or
>> something that would help me figure out how to set permissions for these
>> folks?
>>
>> Any suggestions welcome.
>
>

Posted by =?Utf-8?B?RGF2ZQ==?= on April 28, 2006, 12:07 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
The child domains wasnt done for security reason, it was done because prior
to that, each campus was it's own domain, completely disconnected from the
other campsus. Each site had their own domain name, exchange server, etc.
They were totally isolated. Politically, it was easier to bring them
together as child domains, so the existing campus admins would still have a
sence or control over thier network. When enough of those people left, and
things progressed we were able to centralize things. The final domain
collapse was just hte last step in that centralization.

As was pointed out, my big problem is with the servers being DC's and the
need to let them manage them.

I was thinking of simply making them domain admins, but putting explicit
deny's on the critical servers. Not the best solution, but makes it
easier....



"Joe Richards [MVP]" wrote:

> To add onto Roger's excellent response, you weren't as safe as you think you
> were with the child domains and protecting your HQ. You just didn't understand
> how Windows works. Had a child DA wanted to take over your HQ domain it
wouldn't
> have been a lot of work for them to do so. The domain is not a security
boundary
> in an AD forest.
>


Posted by Joe Richards [MVP] on April 28, 2006, 1:40 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
You can not protect your domain from people you give access to DCs; plain and
simple. Some extremely intelligent people have been working on that problem for
6 years now and there isn't a solution that can't be bypassed. The solution
therefore as to come from MS and the best attempt at it is coming out of Redmond
in Longhorn and is called Read Only DCs with delegated administrator. It won't
be a solution for everyone as there will be caveats. As to what they are it
isn't known yet, they are still building the stuff. :)

Forests, regardless of the number of domains, should have one small (3-8) set of
domain admins who are also enterprise admins who do management of all DCs. No
one else should have any builtin rights such as account operator or server
operator or even local logon onto Domain Controllers. I ran a Fortune 5 global
company like that, 9 domains, 250,000 users, ~400 DCs spread across nearly every
time zone in the world and all managed out of Dearborn Michigan by 3 engineers
and a supervisor.



Anyway, in the last post I was directly responding to your comment of

"Previously, each campus was their own child domain, so each one could be a
domain admin, and not have to worry about them having access to sensitve
material back at the corporate HQ."

That is completely incorrect. Any time an admin in a child domain wanted access
to sensitive material back at corp hq they could have gotten that access unless
you were using some form of third party encryption that has no dependence on
Windows security.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm



Dave wrote:
> The child domains wasnt done for security reason, it was done because prior
> to that, each campus was it's own domain, completely disconnected from the
> other campsus. Each site had their own domain name, exchange server, etc.
> They were totally isolated. Politically, it was easier to bring them
> together as child domains, so the existing campus admins would still have a
> sence or control over thier network. When enough of those people left, and
> things progressed we were able to centralize things. The final domain
> collapse was just hte last step in that centralization.
>
> As was pointed out, my big problem is with the servers being DC's and the
> need to let them manage them.
>
> I was thinking of simply making them domain admins, but putting explicit
> deny's on the critical servers. Not the best solution, but makes it
> easier....
>
>
>
> "Joe Richards [MVP]" wrote:
>
>> To add onto Roger's excellent response, you weren't as safe as you think you
>> were with the child domains and protecting your HQ. You just didn't
understand
>> how Windows works. Had a child DA wanted to take over your HQ domain it
wouldn't
>> have been a lot of work for them to do so. The domain is not a security
boundary
>> in an AD forest.
>>
>

Similar ThreadsPosted
Local Admin access through Active Directory April 6, 2006, 7:43 pm
Detecting Admin Privileges Via Code July 22, 2008, 2:36 pm
active directory August 24, 2005, 6:52 pm
Active Directory and DMZ February 11, 2008, 10:12 am
Need help on Active directory server August 12, 2005, 6:29 am
Active Directory and SSL Certificates January 11, 2006, 5:08 pm
dates in active directory February 20, 2008, 6:04 pm
Using IPSec with Active Directory authetication September 5, 2005, 2:52 am
IIS 6 w/ NT 4.0 and Active Directory Domain Accounts October 11, 2005, 1:16 pm
User Rights In Active Directory January 11, 2006, 12:50 pm

The site map in XML format XML site map

Contact Us | Privacy Policy