Local Admin Rights on a DC

[matt]

We need to give a few users local rights to do software
install and changes to a DC but have no rights to the
domain.
How do we do it?
Its fine if the machine is not a DC but it needs to be
because it the only server in a remote site.

 

[Nathan]

you should check in active directory, the security tab
under the properties of the domain (found in Active
Directory Users and Computers), this will let you set who
has rights in the domain. The rights to install software
is just as with any other machine.

So if administrator group has rights in the domain, don't
just add the users to the administrator group, but create
another group for the users and assign permissions to this
instead (following the AGDLP model should make it simpler
in the future)

Hope this helps

 

[Michael Cartier]

I would think that this would work the same as MS recommendation on Terminal Services on a Domain Controller. I believe they say if it is "needed" to create a separate OU and move the DC to that OU. You can then set a Group Policy and give rights for your Group\User to log on locally.

We need to give a few users local rights to do software
install and changes to a DC but have no rights to the
domain.
How do we do it?
Its fine if the machine is not a DC but it needs to be
because it the only server in a remote site.