Post by CosmoThank you all for your responses :-)
As the AD 'Builtin\Adminstrators' only provides local admin rights on DC's,
how do I make trusted security groups from other domains a member of my local
'Domain Admin' group?
As the 'Domain Admin' group is a GG, it can only contain members from the
the local domain.
That's correct, the AD 'Builtin\Adminstrators' have complete and
unrestricted access to the computer/domain. Read the description under the
General Tab of the AD 'Builtin\Adminstrators.'
Keep in mind, it is a Domain Local group. Because of that, you can add
users, global and universal groups from its own domain and any trusted
domain, as well as other Domain Local group from its own domain (this is
called "nesting") providing anyone that has been added to the Local
Adminstrators group complete and unrestricted access to the DC and domain
resources (including all DCs, member servers and client machines).
And you are correct that you cannot add a Local Group to a Global Group, but
you can add a Global Group to a Domain Local group, hence is the basis of
the AGGUDLP guideline. Basicaly, it's ADDLP, but because of nesting, you can
also look at it as AGGUDLP, or even ADDUUDLDLP, etc.
I'll try to explain it again in better detail using ADDULDP that I
originally explained:
AGGUDLP:
A: Add a user
G: to a Global Group
G: which can be nested into another Global Group
U: which then can be added to a Universal Group, (which can also be nested
into another
Universal Group),
DL: which can be added to a Domain Local Group,
P: you then provide permissions to the Domain Local Group.
Because of the multi-level nesting into the Domain Local Group, any
permissions or rights you give the Domain Local Group (or that has them by
default such as the Administrators Domain Local Group), the users in any of
the groups that are nested, will have those permissions and rights.
By default, the Domain Admins group has already been added to the
Administrators Domain Local group, which is where the Domain Admins group
gains it's powers.
This guideline and Microsoft 'best practice' rule has been around since the
original NT 3.1 days, not including Universals of course, because that came
out with Windows 2000.
Keep in mind, this is a just a guideline. You can do it any way you want. I
like this because as a company grows, it helps because you don't have 500
users in a resource, which takes the system longer to enumerate, rather
simply one group SID which offers extremely fast enumeration.
You can also simply add a user directly to a resource (printer, folder,
etc), or simply add the Domain Local Group to the resource, and provide
permissions to the Domain local Group, and once you add other groups or
users to the Local Group, they gain the permissions and rights on the local
group.
Here is more info:
Understanding & Effectively Using AGDLP
http://troy.computertraining.edu/index.php/understanding-effectively-using-agdlp
AGDLP - From Wikipedia, the free encyclopedia
http://en.wikipedia.org/wiki/AGDLP
AGLP Group Model:
http://groups.google.com/group/microsoft.public.cert.exam.mcse/browse_thread/thread/ba80bb522c13798b/56de1bc78d48dafc?lnk=st&q=aglp&rnum=1#56de1bc78d48dafc
And to add a Global or Universal group from a trusted domain, you go into
YOUR Domain Local Group, click Add, change "Location" to the trusted domain,
and choose their Domain Global Group. Matter of fact, you will see
everything on the trusted side except their Local Groups, because the system
will not allow to add Local Groups to other Local grouups in other domains.
If clicking on the Location button doesn't show the trusted domain, then the
trust is not setup correctly.
I hope that all makes sense.
Ace