Child domain - Global group permissions

[Rob]

I am having a problem assigning Domain Admin privileges in child domain. I
have normal user accounts in a parent domain that need Domain Admin
privileges in a child domain. Apparently by-design, this can't be done,
since the domain admins group is a global group.

Is there a work around or magic that will accomplish the same?

Rob

 

[Miha Pihler]

Microsoft's recommendation for permission delegations is "AGDLP"

This means you put _A_ccount to _G_lobal Group. You should place Global
group to (Domain) _L_ocal group and assign permission to it...

To put it another way. Create new Domain Local group and add Global group
from other domain. Assign permissions to your resource using newly created
Domain Local group...

I hope this helps,

Mike