Re: Domain Admins Group -- Trying to trim membership

Uncle Joe? LOL.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm



Steven L Umbach wrote:
Well hopefully Uncle Joe will reply also as he is one of the world experts on this topic. My two cents is that the risk of a misconfiguration or security breach rises almost exponentially with the number of domain admins you have so it makes sense to have a rather small group of only the most very trusted and competent people being domain admins.

In general almost all Active Directory management tasks can be delegated to a qualified regular domain user by managing AD object permissions. Such tasks could be creating and managing user and computers accounts, creating and managing groups, creating and managing OUs, and editing Group Policy. Of course there are things that only domain level administrators can do but those tasks such as managing privileged users/group, fsmos, global catalog servers, installing hardware/software on domain controllers, dcpromoing a server, installing a Certificate Authority, etc. usually are not done every day or even every week and domain admins need something to do. An existing domain controller can also be dcpromoed to a regular server if you need non domain admins to service it. In a larger network I would think that domain controllers are only domain controllers running DNS and not also a print, file, DHCP/wins, or remote access server which make it easier to not want to allow other users to configure. There is a group called DNS administrators you can add users to if you need them to manage DNS and not be a domain level administrator. The white paper in the link below may be helpful. --- Steve

http://www.microsoft.com/downloads/details.aspx?FamilyID=631747a3-79e1-48fa-9730-dae7c0a1d6d3&DisplayLang=en


"Tom Glasser" <TomGlasser@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:7E31AF20-C60D-49F6-ABE6-F910B0A6E584@xxxxxxxxxxxxxxxx
I am being requested to analyze the current 15 - 20 members of the
Domain Admins group with the goal of reducing membership in this
group to an absolute minimum. But it seems at first blush that mem-
bership in this group is necessary to maintain various functionalities.

Is this a common problem in the Windows Server world? Anyone have
similar experiences to share or any advice on attacking this issue?

Thanks!
Tom


.

Relevant Pages

  • Re: Domain Admins Group -- Trying to trim membership
    ... very trusted and competent people being domain admins. ... a qualified regular domain user by managing AD object permissions. ... server, installing a Certificate Authority, etc. usually are not done every ... controllers are only domain controllers running DNS and not also a print, ...
    (microsoft.public.win2000.security)
  • Re: Domain Admins Group -- Trying to trim membership
    ... Joe Richards Microsoft MVP Windows Server Directory Services ... number of domain admins you have so it makes sense to have a rather small ... Such tasks could be creating and managing user and computers accounts, ... In a larger network I would think that domain controllers are ...
    (microsoft.public.win2000.security)
  • Re: 2003 Migration
    ... Best Practice Active Directory Design for Managing Windows Networks ... Windows Server 2003 Tools ... ensure that you have designed a DNS and Active ...
    (microsoft.public.windows.server.active_directory)
  • Re: i got 6 server in company which contains NT4 , windows 2000 , windowser 2003
    ... Best Practice Active Directory Design for Managing Windows Networks ... Windows Server 2003 Tools ... ensure that you have designed a DNS and Active ...
    (microsoft.public.windows.server.active_directory)
  • Re: Urgent Advise - [WildPacket]
    ... Best Practice Active Directory Design for Managing Windows Networks ... Windows Server 2003 Tools ... ensure that you have designed a DNS and Active ...
    (microsoft.public.windows.server.active_directory)