Archived from groups: microsoft.public.win2000.active_directory (More info?)

I have several DHCP servers running on domain controllers, all in one domain.
If I put a user in "DHCP Administrators", the user can manage all the DHCP
servers that are DCs. Is there a way to restrict access, so that a user can
only manage DHCP on a specific server?

I have been unable to find any documentation as to what rights/permissions
are granted to "DHCP Administrators". I do know that the group is not
assigned any NTFS permissions on the DC. Also, it does not appear to get
any Active Directory rights to the DCs. Microsoft's white paper on best
practices for delegating AD administration does not include any mention of
DHCP administration--because it is not a default part of AD, I suppose.

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Im sure it can be done but it will not be supported. DHCP administrators is
a built in group to manage DHCP servers within a domain. Why would you want
anyone messing around with your DHCP servers in production environment?

Regards

--
The AD Designer
(For a limited period only)


"Sam Smith" wrote:

> I have several DHCP servers running on domain controllers, all in one domain.
> If I put a user in "DHCP Administrators", the user can manage all the DHCP
> servers that are DCs. Is there a way to restrict access, so that a user can
> only manage DHCP on a specific server?
>
> I have been unable to find any documentation as to what rights/permissions
> are granted to "DHCP Administrators". I do know that the group is not
> assigned any NTFS permissions on the DC. Also, it does not appear to get
> any Active Directory rights to the DCs. Microsoft's white paper on best
> practices for delegating AD administration does not include any mention of
> DHCP administration--because it is not a default part of AD, I suppose.
>

Archived from groups: microsoft.public.win2000.active_directory (More info?)

The capacity to "mess around" is inherent in delegation. In this case I am
willing to live with the risks, so long as I can control it by office. We
have multiple offices around the world. As an example, I would like for the
Paris office to be able to reserve an address for themselves on the DHCP
server in their office, but not for any other office. That way, they can
manage--and mess around with--DHCP in their office without affecting others.
It is one less thing for me to deal with.