Segmenting which IT admins can access various servers

[Albert M Gostick]

Hi,

We have a couple dozen servers in our environment and right now, all IT admins can access all servers because all IT admins are part of the Domain Admins group and every server has "Domain Admins" as part of the local Administrators group on that server. Or at least that is how the permissions are being granted from what I can tell.

But I would like to change it so that this is split between senior admins and regular admins. This is what I would envision:

- These groups in AD:

- Senior Admins

- Regular Admins

and then for the servers:

- Critical Servers (or something to denote domain controllers, Exchange server etc)

- Non-Critical Servers (file servers, utility servers etc)

Then the IT people get put into the first 2 groups and the servers go into one of the server groups

Then I suppose that one of the two server groups goes into the local Administrators group on each server so that each person can RDC into the servers that they need to work on and have full rights to work on that server.

Is this the correct way to do this or is there something built-in within AD groups to do the same?

Thanks.

Continue reading...