1

Forgive any errors in terminology!

Alright. We have a domain, and 3 subdomains. My account, of course, is on one of the child domains.

I need to be able to administer accounts on the other domains, and I would MUCH rather use Users and Computers on my machine rather than logging into a server with RDC.

Is there anyway to get my account to be a domain admin on all the servers? When I try to add a user to the domain admin group on the parent server, and choose my server to look in, AD will only look at Contacts or Other.

If that will not work, can I create a user on the parent server and set it to be an admin on all the child servers as well?

Thanks!!!

4 Spice ups
2

If you are supposed to have accross the board rights can they just add you to Enterprise admins to keep it simple?

2 Spice ups
3

I tried that also. There is not an Enterprise admins group on my server, and I have the same problem adding my account on the Enterprise admins group on the parent server as I do on the domain admins group.

4

If you are only an admin of one of the child domains you will not be able to elevate your rights. You will need an admin from the parent domain to do that or one of the admins from the other child domains to add your account to their admin groups on the servers you want to access assuming that there is a trust between the child domains.

2 Spice ups
5

I have been trying to change my rights while logged into the domain admin account on the parent server.

6

Is the issue that you have credentials on the other domains, but you would rather just run Active Directory Users and Computers locally on your workstation under your account in a child domain?

If so, you can use RunAs with the MMC console

runas /user:PARENTDOMAIN\USER “mmc %windir%\system32\dsa.msc”

7

+1 for what Birda said. You cannot just add yourself as an admin to the other domains, you need someone who already has the elevated privs to add you. We ran into that a LOT at IBM when administering client’s accounts. Gaining access was the hardest part of support on some of those accounts. Hopefully someone knows the credentials for the Ent Admin account and can add you. otherwise you will need to get someone who is an Admin on the other two accounts to add you and hope one of them has access to the root (parent) domain.

1 Spice up
8

Check your forest (above the domain) for the Enterprise Account.

9

I have the admin password (yes, one password, not happy) for all the domain admin accounts. I have been using the domain admin account to try to change my rights, but I might not be doing something correctly.

Daniel, pretty much. I have the administrator password for all the domains. I have been using RDC and logging into the exchange server on each domain as the administrator for that domain to change passwords. (I forgot, while pushing for everyone to change their passwords, including those using password as a password, that those just using webmail, a great part of our users, have no way to change the password themselves… they can just call me… sigh.)

And, thanks. I think that’s probably what I’ll do. If I run it as the parent server’s admin account, I should be able to open multiple instances, and pull up each server, rather than changing the domain as needed, since it’s SLOW!!!

10

What version of Exchange do you have?

You can setup Exchange to allow users to reset their passwords via OWA.

Exchange 2003

http://support.microsoft.com/kb/297121

Exchange 2007

Exchange 2010

11

And, yes, I know. But your server has to be configured to use SSL. Which I think would also require an SSL certificate. Not happening here. :: rolls eyes ::

12

Well that just sucks!

You could do a self signed cert for use with just the password exchange feature, but the users would get the lovely untrusted certificate Internet Explorer screen.

13

The average age of my users is about 77. We were having problems with an intrusted cert on a login portion of our site. :: Shudder :: Sending them a guide with screencaps and ARROWS pointing to what they needed to click didn’t even help!!!

Also, the uni I worked for previously had a TON of problems with changing passwords via OWA. Very few people could get it to work. Moving to 2010 helped there, but I’m not going to be able to get them to upgrade for… years.

14

:frowning:

Well I’m glad you can run ADUC locally now :slight_smile:

15

Personally I’d be a bit worried that there’s no propagation of the Enterprise Admin group down to all the servers in the forest, like something didn’t take when they were dc-promoted…

…unless they weren’t promoted, in which case I’d do that first. :slight_smile:

Secondly I would just use the MMC AD Users and Computers plugin on the workstation and use that to connect to each server to adjust rights instead of killing time on RDC.

16

I can run it as the admin account on the parent server.

The org I work for uses a tech support company. My job is to be an liaison between the tech company (Company A) and the org. After some to-doing with the company Company A outsources first level tech support to (Company B), I’m first level tech support. This was first defined as anything user side. Then, “Oh, go ahead and do the SEP rollout by yourself. You’ve never done that before? How fun for you!” Now, if I do something big on a server, I need to notify them first. :: rolls eyes ::

I asked them about… 3 weeks ago to set me up as an admin on all 4 servers, and to create an account for their people, and accounts for our contractors instead of EVERYONE USING THE DOMAIN ADMIN ACCOUNTS!!!

They finally got around to creating the accounts this week. So I’m guessing I’ll just go in and create me an account on the parent server and set it as a domain admin. Not happy with this company right now…

17

You will have to get someone who is a Domain Admin in the root domain to add you to Enterprise Admins. That will then allow you to access all the other Domains through your AD Users & Computers tools loaded on your machine.

Who is the tech company that you use?

18

jeremymaritz wrote:

Personally I’d be a bit worried that there’s no propagation of the Enterprise Admin group down to all the servers in the forest, like something didn’t take when they were dc-promoted…

…unless they weren’t promoted, in which case I’d do that first. :slight_smile:

Secondly I would just use the MMC AD Users and Computers plugin on the workstation and use that to connect to each server to adjust rights instead of killing time on RDC.

I must have missed a post but from my read it looks like she’s the admin of one of the child domains, and likely in it’s local admin group.

I think the root issue here is a goofy AD structure to go along with a goofy administrative users policy. If she needs to manage all domains she should be in the parent domain, in the administrative OU and be in a “Admins” group as well.

At least that’s how I’d do it :slight_smile:

19

“Goofy” is one way to put it. :slight_smile:

I’ll be throwing up another topic soon about the AD structure. Mainly in the use of subdomains verses domain controllers… This just doesn’t make sense.