RE: [ActiveDir] Delegation of privilege

[Rick Kingslan]

ROTFLMAO!   OK, that caught me completely off guard…..   Rick   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dean Wells Sent: Thursday, July 21, 2005 4:07 PM To: Send - AD mailing list Subject: RE: [ActiveDir] Delegation of privilege   Fear not, joe's knowledge and use of English is only marginally better than yours and he's been at it for decades ...   PS - I'm just teasing for those that didn't catch that ;o) -- Dean Wells MSEtechnology * Email: [EMAIL PROTECTED] http://msetechnology.com     From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of TIROA YANN Sent: Thursday, July 21, 2005 5:00 PM To: ActiveDir@mail.activedir.org Subject: RE : [ActiveDir] Delegation of privilege OOOooopppsss ..... sorry... i  did not understand  joe's metaphors.... i'm a bit ashame :( So please, do not laught at me,  i try my best to improve my english :o)   Now it is time for me to go to the next chapter of my english training: Chap 3 "Understanding metaphors"  :-)   Cheers,   Yann   De: [EMAIL PROTECTED] de la part de Rick Kingslan Date: jeu. 21/07/2005 22:20 À: ActiveDir@mail.activedir.org Objet : RE: [ActiveDir] Delegation of privilege >>  "You honestly have two real answers in my book”  joe currently has one book (in process) – and chapters in others.  :o)   When he uses the phrase above, he is saying – “To my way of thinking, best practices say you have two things you can do” English is a very strange language, and then us ‘native speakers’ go and mess it up even more with metaphors and analogies. ;o) Rick From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of TIROA YANN Sent: Thursday, July 21, 2005 3:04 PM To: ActiveDir@mail.activedir.org Subject: RE : [ActiveDir] Delegation of privilege   Hi joe,   I now realize that my question was not safefull in an AD design. I wanted to do the same as a NT4 domain where it is (not very sure, but i think it is) possible to give someone admin privilege on only one DC. I thought i could do the same thing with AD 2003.   Yes this DC is also file&print server, but for more secure operations, we will probably (and certainly) move this role to a another member server, and so give THAT user server op privilege :)   Anyway, u said "You honestly have two real answers in my book". May i ask u what is the title of your book ? is it an AD or/and w2k3 book ? I would be interested about it's content...   Cheers,   Yann De: [EMAIL PROTECTED] de la part de joe Date: jeu. 21/07/2005 02:37 À: ActiveDir@mail.activedir.org Objet : RE: [ActiveDir] Delegation of privilege Sakari, you are scaring me here...   Yann, you are basically saying. "Hi, I need to give someone I don't trust enhanced rights on only a single domain controller so they can not hurt other domain controllers.". This is not really possible. You can do a lot of one of delegation pieces but you aren't really doing a whole lot to protect yourself from the fact that you don't trust this person to have access to all of your DCs. Once on the one DC, one of many techniques can be used to get themselves access to the rest.   You honestly have two real answers in my book.   1. Break the work up into something the non-trusted person can do and the rest is given to a DA to do.   2. Find some other way to do the work, usually some form of proxy based solution that has rules you can apply so the person can't just do what they want, but instead only what you allow them.   Of course the other thing to do is not do what it is you are doing with that DC which is probably something like sharing files or printers or something like that.     joe   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sakari Kouti Sent: Monday, July 18, 2005 6:01 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Delegation of privilege Hi Yann,   You could grant your user those privileges that are listed as User Rights, by applying a corresponding Group Policy Object to only one DC. However, this is probably not enough for you. For example, you cannot grant a privilege to format hard drives or share folders this way.   Yours, Sakari       From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of TIROA YANN Sent: Monday, July 18, 2005 8:39 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Delegation of privilege Hello AD Gurus :)   I would like to give to one of my user "server operator" privilege on only one DC, and not the whole DCs of my AD 2003. I know that DCs do not have sam locally, and the only way to give this privilege is to use the Built-in Groups in the Built-in Container. But doing this allow my user to be server op for all DCs in my domain.   The purpose of my question is; => to give one user the privilege to fully manage *only one*  DC  with "server operator" privilege, without having the right to use MMCs such as ADUC, Schema, dssite, replmon, repadmin commands.   Is this possible ?   Thanks for input.   Cheers,   Yann