Our domain is trusting an external domain (not in the same forest) and we need to add a group from the external domain into the Domain Admins group of our domain.
I understand that the Domain Admins group is a global group, so we cannot add groups from other domains into it. But I have seen several workarounds on the internet, but none of these seem to work in our situation.
I tried creating a universal group and a domain local group, but I cannot add either of these to the Domain Admins group and only the domain Local groups lets me add accounts from the external trusted domain.
Global security group (e.g. Domain Admins)
- Can add Domain Local group: No
- Can add Global group: Yes
- Can add Universal group: No
- Can add from trusted domain: No
Universal security group (e.g. Enterprise Admins)
- Can add Domain Local group: No
- Can add Global group: Yes
- Can add Universal group: Yes
- Can add from trusted domain: No
Domain Local security group (e.g. Administrators)
- Can add Domain Local group: Yes
- Can add Global group: Yes
- Can add Universal group: Yes
- Can add from trusted domain: Yes
| Group can contain members of type |
| Group type | Global | Universal | Domain local | Trusted Foreigners |
|--------------|--------|-----------|--------------|--------------------|
| Global | Yes | | | |
| Universal | Yes | Yes | | |
| Domain local | Yes | Yes | | Yes |
The Global Domain Admins group can only contain other Global groups.
And Global groups cannot seems to directly (or indirectly) contain principles from foreign domains.
Workaround
An awful workaround might be:
I have a group that i want added to every local Administrators group on every machine in the domain:
How can I add a group to the Administrators group on every machine in the domain?
Cannot work; a Domain local group cannot contain other Domain local groups.
The only workaround i can see is manually create duplicate accounts for every user in the local domain
Cons: decreased network security, lower user productivity, complicates administration, worse administrative control, inconsistent policies, increased TCO.
Bonus Chatter
From Application Specification for Microsoft Windows Server, Chapter 5. Security Services:
Single Sign-On (SSO) allows enterprise network users to seamlessly access all authorized network resources, on the basis of a single authentication that is performed when they initially access the network. SSO can improve the productivity of network users, reduce the cost of network operations, and improve network security.
Better network security. All SSO methods available under Windows provide secure authentication and provide a basis for encrypting the user's session with the network resource. Eliminating multiple passwords also reduces a common source of security breaches - users writing down their passwords.
Improved user productivity. Users are no longer required to remember multiple logons, nor are they required to remember multiple passwords in order to access network resources. This is also a benefit to help desk personnel, who need to field fewer requests for forgotten passwords.
Simpler administration. SSO-related tasks are performed transparently as part of normal maintenance, using the same tools that are used for other administrative tasks.
Better administrative control. All SSO-specific information is stored in a single repository, the Active Directory. Because there is a single, authoritative listing of each user's rights and privileges, the administrator can change a user's privileges and know that the results will propagate network wide.
Consolidation of heterogeneous networks. By joining disparate networks, administrative efforts can be consolidated, ensuring that administrative best practices and corporate security policies are being consistently enforced.
