Hi, I'm in process of remove all users from domain admin and assign them the rights which they need in ad Can someone please let me know which rights I need to give Support_Senior - Able to do anything within active directory (Join to domain, edit/update/create/delete users/computers, create/delete/update OU) Support_Tech - should be able to join computer to domain. edit/update/create/delete users/computers should not be able to create/delete/update OU

Hi @lalajee , This is a good approach to improve security state of your active directory. Regarding AD objects, you can based on structure organizational Unit set delegations to give permission to a user or security group to manage objects under a specific organizational unit. For your case you can create two security group : one for Senior and one for tech. Senior group will have full control on all objects in the OU and tech group will have control only on computer objects as mentioned in the article below: DELEGATING COMPUTER OBJECT MANAGEMENT TASKS Please don't forget to mark helpful answer as accepted

Assign permissions to active directory though security groups

Accepted answer

Thameur-BOURBITA 32,496 Reputation points

2023-01-24T20:22:46.86+00:00

Hi @lalajee ,

This is a good approach to improve security state of your active directory.

Regarding AD objects, you can based on structure organizational Unit set delegations to give permission to a user or security group to manage objects under a specific organizational unit.

For your case you can create two security group : one for Senior and one for tech.

Senior group will have full control on all objects in the OU and tech group will have control only on computer objects as mentioned in the article below:

DELEGATING COMPUTER OBJECT MANAGEMENT TASKS

Please don't forget to mark helpful answer as accepted
Please sign in to rate this answer.

1 person found this answer helpful.
lalajee 1,811 Reputation points

2023-01-27T23:16:32.5466667+00:00

I have apply the permission for each group but I have few question regrading admin groups

Do I need to apply new groups on admin groups e.g. domain admin, enterprise admin

lalajee 1,811 Reputation points

2023-01-27T23:19:40.7133333+00:00

I have apply all of the permission which I need for each group.

I have question regrading admin groups, Do I apply permission on domain admin, enterprise admin.

All admin groups permission inheritance is disabled

SF-6505 411 Reputation points

2023-01-28T12:09:16.76+00:00

Hi

I think inherited permissions for built-in admin group. If you disable them ,they risk to loose permissions on child objets. I think you should reapply all permissions manually in this case

Thameur-BOURBITA 32,496 Reputation points

2023-01-28T12:22:42.0233333+00:00

Hi @lalajee

I have question regrading admin groups, Do I apply permission on domain admin, enterprise admin

By default , all default admin group like domain admins and enterprise admin , have full access on all OUs due to inherited permission propagated from domain level.
If you disable permission inheritance you have to apply them manually for domain admins and enterprise admins

Please don't forget to mark helpful answer as accepted*

lalajee 1,811 Reputation points

2023-01-28T14:40:45.69+00:00

Sorry my question is not to disable inherited permission

My question is do I need to add new security groups to builtin admins e.g. domain admin

Once I do take permision from user account they will not be able to add them self or any user to domain admin as they will not have access to these accounts

Thameur-BOURBITA 32,496 Reputation points

2023-01-28T23:26:07.5666667+00:00

Hi @lalajee

My question is do I need to add new security groups to builtin admins e.g. domain admin

No, because the admin account member of one of new security groups will have sufficient permissions on target AD objects to perform his task thanks to the delegation model configured at OU level mentioned on the link in my previous answer.

The number of domain admin members should be limited.

Please don't forget to mark helpful answer as accepted

Thameur-BOURBITA 32,496 Reputation points

2023-02-03T23:09:09.2733333+00:00

Hi @lalajee

just checking if there is any update about your question ?

Please don't forget to mark helpful answer as accepted
Sign in to comment

Assign permissions to active directory though security groups

1 additional answer