1

I have a Windows Server 2008 AD domain, with 2 domain controllers, one with Windows Server 2008, the other with Windows Server 2008 R2. The second is the main DC.

I'd like to create a user who is a local administrator of the first domain controller (windows server 2008), but cannot access, for example, the shared folder of the other domain controller, or use the account to log in with mstsc on another member of the DC, so it hasn't to be a domain administrator.

Is this possible?

0

1 Answer 1

2

There's no such thing as a local user on a domain controller, only domain users.

When you promote a computer to a DC, it copies all users from the local SAM to the domain, and stops using the SAM.

The local SAM is still there, but is only used in Directory Services Restore mode.

You may want do something like make them a regular user, limit their logon capabilities to just that machine, and then delegate AD jobs they may need to do (add users, unlock accounts, etc.).

2
  • 1
    This user is already a domain normal user. It has to install programs, and manage the domain controller software, but must not see the files on the other DC. Also, he should not be capable to change the AD configuration.
    – Perocat
    Aug 30, 2013 at 11:40
  • Not sure what you're exact requirements are, but sounds like you need to be doing this on a computer that isn't a DC. If they are allowed to install software on your DC, then they can easily lift your other admin passwords using freely available utilities, and then do/go whatever they want. Aug 30, 2013 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .