So, let's touch on the topic of Active Directory domain trust relationships and dig into how an administrator of one domain can be given domain admin rights in another domain.
We have:
- Domain 1 (Domain1).
- Domain 2 (Domain2).
- A transitive trust relationship configured between these two domains.
Our task - being administrators in one domain (Domain1) - is to obtain domain administrator rights in the second domain (Domain2). This way, working on a computer located in domain Domain1, under a Domain1 domain account, you'll be able to manage servers and computers in domain Domain2, access their administrative share, get unconditional RDP access as an administrator, and automatically have local administrator rights on machines in domain Domain2 - all without having an account in Domain2.
This way, if you're the administrator of some holding company with several domains (two domains, in the initial case), you'll be able to go to computers in other domains and manage them just like computers in your own domain.
Let's begin.
1) In Domain1 we'll create a security group, into which we'll include all the accounts that should be considered domain administrators in Domain2. Let's call it "Administrators from Domain1".
As a special case: if we want all Domain1 domain administrators to have domain administrator rights in Domain2, we create the group "Administrators from Domain1" and include the "Domain admins" group in it (or "Domain Admins" if the domain was created in Russian).
2) We give the "Domain1\Administrators from Domain1" group rights in Domain2.
To do this, we open the "Active Directory Users and Computers" snap-in on the Domain2 domain controller, go to the "Builtin" section and find the "Administrators" group. We open it and add the "Domain1\Administrators from Domain1" group to it. This tells the Domain2 domain controllers that our guys from Domain1 are administrators.
PS. You CANNOT add the group "Domain1\Administrators from Domain1" directly into the group "Domain2\Domain admins" (Domain2\Domain Admins)! That's why we have to jump through hoops.
3) In domain Domain2 we create a security group (local, not global/domain), into which we include the group "Domain1\Administrators from Domain1". Let's call it "Domain2 Administrators".
By the way, in the future, if you need to grant management rights from several domains at once, it will be enough to modify just this group - and everything will happen automatically.
Besides the group "Domain1\Administrators from Domain1", you can also add your own "Domain2\Domain admins" group (or "Domain2\Domain Admins" in the Russian version) into this newly created group.
4) Creating a Group Policy
The thing is, it's not enough to just add the group "Domain1\Administrators from Domain1" into "Builtin\Administrators" - that will only give rights on the domain controllers themselves. We also need to tell ordinary computers and servers that we want to administer them.
To make this happen, we need to open the Domain2 Group Policy editor and create a new policy. We'll place it in domain Domain2 and leave the default filter as "Authenticated Users" - then the policy will apply to all computers and servers in domain Domain2.
4a) We open the Domain2 Group Policy editor (exactly how it's opened depends on the Windows Server version - for 2008 it's Start->Administrative Tools->Group Policy Management; for 2003 it's a separate application downloadable from Microsoft with a name like "Group Policy Editor" or something like that, I don't remember exactly anymore).
4b) We create a new policy and place it in the Domain2 container.
4c) We open it for editing and go to:
Computer Configuration -> Preferences -> Control Panel Settings -> Local Users and Groups
4d) We create a new item, in which we specify:
Action: Update
Group name: Administrators (built-in account)
Click "Add" and add the group "Domain2\Domain2 Administrators".
Close everything via OK - and that's it, we're done with Group Policy.
5) Now we'll have to wait until all computers and servers refresh their Group Policy. After that, an entry will appear in their local security policy stating that the group "Domain2\Domain2 Administrators" should be considered local administrators, and this group contains users from the group "Domain1\Administrators from Domain1", and accordingly, Domain1 administrators get administrative access both to machines in domain Domain2 and to managing Domain2 accounts.
PS. But it turns out this scheme doesn't let you manage Group Policy itself this way. Presumably you'd also need to add it to some other Builtin group following the example in step 2. I haven't figured this out yet - it's not urgent for me. I'll find out and update this.
Comments