Limit Administrator Access to only OS Level functions on a Windows 2003 (and up) Domain Controller Server

Question

<p>I have read several articles such as:</p><p>1.&nbsp; <a href="http://social.technet.microsoft.com/Forums/windowsserver/en-US/9c723f4a-51a7-4844-9dc6-0017355d694c/limited-administrative-on-domain-controller?forum=winserverDS">http://social.technet.microsoft.com/Forums/windowsserver/en-US/9c723f4a-51a7-4844-9dc6-0017355d694c/limited-administrative-on-domain-controller?forum=winserverDS</a></p><p>2.&nbsp;
Active_Directory_Delegation.doc</p><p>Consider that a domain controller, doing no other functions than domain based functions (ie no file server, printer or app server) - is managed in two parts:&nbsp; The OS-only level, to read log files,
server health monitoring, install OS-level Micrsoft security patching and the second part being Domain management level - Users and Computers, Domains and Trusts, etc).</p><p>For a given domain controller server, an outsourced support&nbsp;group&nbsp;needs
to be responsible for the OS-only level access - they need no access to the Domain management level functions so they can fufill contractual obligations (SLAs) for server uptime, patching etc.&nbsp; </p><p>For the same given domain controller
server above, there is an internal (non-outsourced) support group that will perform all Domain management level functions only.&nbsp; They want to manage the Domain on the Domain Controller servers, want the Outsourcer to manage the VM and OS-related tasks,
but DO NOT want them to be able to access and change information in Users and Computers, Domains and Trusts etc.&nbsp; </p><p>With that explaination, would putting the Outsourcer's AD-based account IDs in the Server Operators group alone be
sufficient to allow OS-level management, like patching, reboots, etc but disallow access to Domain Management functionality (Users and Computers etc) - or does it need to be a combination of built in groups and delgated rights?</p><p>Please consider
that I am seeking a technical solution here&nbsp;- do not respond with "either trust your Domain Administrators or keep your junior admins from the server" as that is not a viable solution.&nbsp; </p>
Jason B. Allen

Answer 1

Hi Jason,
According to your description, you want to assign the OS-level management and Domain management rights to two groups separately, right?
Based on my research, members of Server Operators group don’t have sufficient rights to install updates for Domain Controllers, you can refer to this article below:
Default groups
http://technet.microsoft.com/en-us/library/cc756898(v=WS.10).aspx
You can configure Allow non-administrators to receive update notifications group policy so that non-administrative users will be able to install all optional, recommended, and important updates content for which
they received a notification, except some updates which contain User Interface, End User License Agreement and so on, which still require domain admin credentials.
To enable non-administrator users the ability of logging onto and shutting down DCs,
Allow logon locally and Shut down the System rights should be granted.
In addition, reading logs and monitoring server performance rights are included on Performance Log Users and Performance Monitor Users groups.
More information for you:
Step 5: Configure Group Policy Settings for Automatic Updates
http://technet.microsoft.com/en-us/library/dn595129.aspx
User Rights Assignment
http://technet.microsoft.com/en-us/library/cc780182(v=WS.10).aspx
I hope this helps.
Amy Wang