Adding user to Child Domain Group

[Tony]

Hello,
1 AD 2003 Forest
1 AD 2003 Child Domain in Forest

I'm trying to add my user account from the parent domain into the Domain
Admins group in the Child Domain but can't. The only option I have is to add
a Contact or Other Object. Users, Groups..etc are not an option. I can,
however, add my user id to the Builtin\Administrators group in the Child
Domain. I would like to administer both domains from one account. What do I
do here?

Thanks,
Tony

 

[Brian Desmond [MVP]]

Tony-

The issue here is group scope. Domain Admins is a global group,
Administrators is a Domain Local group. Adding yourself ot the domain
"Administrators" group gives you almost full control - enough to do most day
to day tasks. Others will require a seperate account.

The reason here is that a global group is exposed to any domain that the
group's parent trusts. In an AD forest, you have implicit trust, but, think
of a situation where child.company.com trusts an external domain
widgets.com. Widgets.com has no idea about the company.com domain where
your account is. Thus, when it sees a group containing users from domains
other than child.company.com it has no way to resolve them.



--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Tony]

Hi Brian,

Ok, I see your point. My problem was that I'm trying to administer
workstations in that domain but can't. What I could do though is create a
batch job that adds the Parent\Domain Admins group to the local ADmin group
on the PC's?

Cheers,
Tony

 

[Herb Martin]

Hello,
1 AD 2003 Forest
1 AD 2003 Child Domain in Forest

I'm trying to add my user account from the parent domain into the Domain
Admins group in the Child Domain but can't.

Domain Admins is a GLOBAL Group.

Global Groups can ONLY contain users from the same
domain (as the Global Group.)

The only option I have is to add
a Contact or Other Object. Users, Groups..etc are not an option. I can,
however, add my user id to the Builtin\Administrators group in the Child
Domain. I would like to administer both domains from one account. What do I
do here?

Put the user (your account) in a Global Group on the source
domain (it's a good practice) and put that group in the
Administrators group (a Local group) of the target.

Local groups can contain Users and Global/Universal groups from
the same or any trusted domain.

 

[Brian Desmond [MVP]]

Yes this would work.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com