Home / server / Questions / 315597
Accepted
abenci
Asked: 2011-09-27 08:11:12 +0800 CST

Best user group for developer domain users

  • 772

What is the best user group for Visual Studio 2010 developers? Now we have added them as Member of Domain Users but under certain situations they need admin account.

We would like to give them more control on their machine but not on the domain network, of course.

Thanks.

windows-server-2008 active-directory user-management

3 Answers

  1. Best Answer

    If they need admin access to their machines, but not the domain at large, you could:

    • individually give them admin access to the local machine (fine if a rare occurrence), or
    • Create a domain group, create an OU of machines these people would need admin rights on, assign the group admin rights to only that OU (reasonable, but a lot of work if this is a rare scenario), or
    • create a domain group, assign it custom permissions to administer all machines in the domain but not the domain itself (least preferable)
    • 1

  2. The best group is the one that gives them the level of access they need to do their jobs but does not give them more access than they need to do their jobs, which is entirely dependent on what it is they need to do, which is determined by their manager.

    • 0

  3. If they are doing web development with anything earlier than visual studio 2010 they are going to need to be administrators of the machine so that they can debug processes running under a different user context. Most of the time this means debugging web apps on IIS. If they switch to 2010 they can use IISExpress instead. If they are doing anything that can be construed as system programming they will need admin access.

    A good idea might be setting up a development forest that they can use virtual machines to do dev on. Developers also use email, calendars, and the like...try to keep those duties separate without deploying two workstations.

    • 0