What is the difference between administrator and domain administrator?

Question

Active Directory

Finally got confused in the access rights in the domain. How to properly configure access for enikeans so that they can set up a client PC that is already in the domain, but did not have access to the domain controller? What are the best practices?

Answer 1

best practices is this - enikei should not have the right to install and configure anything themselves (well, except that the wallpaper can be changed and the speed of the double click of the mouse is not a fact). With the help of group policies, arrange software, make security settings, etc. etc.
In AD, the domain administrator is also the local administrator of workstations.
If you want the user themselves to have the right to set and configure something for themselves, then you can:
1. assign to the unit, for example, an administrator from the unit, then he will be able to manage computers in the unit under his account.
2. Get a local admin on the computers and give users a password from it. But this is a bad choice.

Answer 2

Create a Local admins group, create a group policy that will add this group to local administrators, apply it to the OU where all the OUs of ordinary computers are located. In the group to shove enikeev accounts. Profit.