Jorge's Quest For Knowledge!

All You Need To Know About Identity And Security On-Premises And In The Cloud. It's Just Like An Addiction, The More You Have, The More You Want To Have!

(2006-05-16) Delegation Of Control, How?

Posted by Jorge on 2006-05-16


A tip for delegation (per organization this may depend, but this should give you a hint how to do it):

  • ALWAYS use separate admin accounts to perform admin tasks
  • Define the admin roles in your organization
  • Define all the admin tasks performed by those roles in your organization
  • Create an OU for the Admin roles and the admin tasks
  • Do not delegate the management of the roles and the tasks to groups or persons other than the domain admins
  • Create an OU for the Admin accounts
  • Do not delegate the management of the admin accounts to groups or persons other than the domain admins
  • Setup admin roles represented by a security groups in AD
  • Setup all kinds of tasks represented by a security groups in AD
  • Give the task groups the appropriate permissions in AD and on servers through the delegation of control wizard and through GPOs (restricted groups feature)
  • Make the role groups a member of the appropriate tasks
  • Make the admin accounts a member of the appropriate roles (most of the time 1 admin account only has one role assigned)
  • Protect the admin accounts OU, the admin roles and tasks OU

More information:

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: