Security / Profile Question

[skadrum]

How can I set a user to be able to repair computers / make moderate changes to system settings but now allow them to login to the server or look at other user's personal network drives??

 

[AMD[H]unter]

I need more info. Are they on a domain?

 

[JDMs14]

Give them local admin access?

Are these machines on a domain?

 

[AMD[H]unter]

Also, what's the point of the server if the machines can't access it?

 

[swatbat]

Yea I need more info. When you say personal network drives do you mean network shares that are on the server like each users directory? For that in a domain enviroment I for the most part just set the user dirs with only that user and system access. I also add a single administrator account. That way I can see what is going on but no one elce can.

 

[skadrum]

Yes this is on a domain. The goal is to have the person be able to install software and repair systems but unable to browse other people's network folders.

 

[skadrum]

also, they should not be able to physically login to the server...

 

[Malk-a-mite]

He needs a tech to have local admin rights on the machines, and not domain admin rights.

 

[skadrum]

EXACTLY. how is this achieved? can i make them a member of some specific built in group??

 

[swatbat]

EXACTLY. how is this achieved? can i make them a member of some specific built in group??

Have you set the machines built in admin accounts up with a generic password or anything? I mean if you know the admin passwords on the boxes they could just login to the box as a local login and install whatever they wanted. You can also go through and setup the user folders on the server where only the user can see them on the server and maybe an admin account. Then if the person had access to the machine he/she couldn't see them.