Setting up Permissions on Child Domain's Admin

[Guest]

I have a parent domain called x.com & had to create a child domain child.x.com - Everything is working fine but the problem is by default the admin for child domain can make changes in AD on the parent domain.

I want to restrict the child domain admin to manage everything ONLY within the child.x.com & NOTHING in parent domain.

I have looked for KB Articles but they all poing to OU & delegation of control but that would not fit nor work into my environment. Any help will be appreciated.

 

[Chriss3]

By default the built-in administrator in the particular child domain only
have rights to the particular domain and not any trusted domains in the
forest including the parent domain. How ever make sure the child
administrator not are member of the Enterprise Admins group. Make sure they
are logged in to the child domain also.

--
Regards
Christoffer Andersson

No email replies please - reply in the newsgroup

I have a parent domain called x.com & had to create a child domain

child.x.com - Everything is working fine but the problem is by default the
admin for child domain can make changes in AD on the parent domain.

I want to restrict the child domain admin to manage everything ONLY within

the child.x.com & NOTHING in parent domain.

I have looked for KB Articles but they all poing to OU & delegation of

control but that would not fit nor work into my environment. Any help will
be appreciated.

 

[Guest]

Thanks Chriss3. I did what you had asked it did fix most of my issues. Is there any way where I can stop the lower child level admins to not eve see what users & groups are on the parent domain.
When they go on to domains & trust & click manage on the parent domain they can see all the settings could this be prevented?

 

[Chriss3]

This can be prevented yes with set the List Object Mode (We can do this by
set DS-Heuristics attribute to 0x01), But you should think two times before
you enable this functionality. This is not a default behavior because in a
forest this is expected scenario chose you want to share some information
and may gain access to some recourses across the domains that typical why
you trust domains. This will prevent such features how ever you can use the
VB Script below to set this mode of Active Directory.

More information can be found at:
http://www.windowsitlibrary.com/Content/667/04/2.html

---------------------------------------------------------------
' From the book "Active Directory Cookbook" by Robbie Allen
' Publisher: O'Reilly and Associates
' ISBN: 0-596-00466-4
' Book web site: http://rallenhome.com/books/adcookbook/code.html
' ---------------------------------------------------------------

' ------ SCRIPT CONFIGURATION ------
boolEnableListObject = 1 ' e.g. 1 to enable, 0 to disable
' ------ END CONFIGURATION ---------

set objRootDSE = GetObject("LDAP://RootDSE")
set objDS = GetObject( _
"LDAP://cn=Directory Service,cn=Windows NT,cn=Services," _
& objRootDSE.Get("configurationNamingContext") )
strDSH = objDS.Get("dSHeuristics")
if len(strDSH) = 1 then
strDSH = strDSH & "0"
end if
strNewDSH = Left(strDSH,2) & boolEnableListObject
if len(strDSH) > 3 then
strNewDSH = strNewDSH & Right(strDSH, len(strDSH) - 3)
end if

WScript.Echo "Old value: " & strDSH
WScript.Echo "New value: " & strNewDSH

if strDSH <> strNewDSH then
objDS.Put "dSHeuristics", strNewDSH
objDS.SetInfo
WScript.Echo "Successfully set list object mode to " & _
boolEnableListObject
else
WScript.Echo "List object mode already set to " & boolEnableListObject
end if



--
Regards
Christoffer Andersson

No email replies please - reply in the newsgroup

Thanks Chriss3. I did what you had asked it did fix most of my issues. Is

there any way where I can stop the lower child level admins to not eve see
what users & groups are on the parent domain.

When they go on to domains & trust & click manage on the parent domain

they can see all the settings could this be prevented?

 

[Jimmy Andersson [MVP]]

Just want to add some info about the dsHeuaristic attribute, it's the third
flag that needs to be set to 1 (or above) the first two controls the ANR
search.

Regards,
/Jimmy