Domain Admin Rights Tool

abelamorales

Hey guys,

Are there any solutions out there that automates the granting of domain admin rights temporarily? For instance, let's say there is a change management request that requires elevated rights, the engineer fills out a separate request for the domain admin rights for X hours, once approved, they are granted and rights will be revoked once the X hours has expired.

I've searched online, but may not be searching under the right terms. Please let me know what you guys are doing in your environment. Our goal is to remove ALL domain admin rights.

Thanks,

Abel

cyberguypr

I think you are looking for something like PowerBroker: http://www.beyondtrust.com/Content/pdfs/DS-PowerBrokerWindows.pdf

abelamorales

Thanks, Cyberguypr. I thought PowerBroker allows temporary elevated rights for local admins, it has the capability to do so for Domain Admins as well? Also, I believe PowerBroker elevates based on the process, not necessarily granting Domain Admin privileges.

cyberguypr wrote: »

I think you are looking for something like PowerBroker: http://www.beyondtrust.com/Content/pdfs/DS-PowerBrokerWindows.pdf