K.2 Active Directory Administrative Users and Groups

Administrative access to NSS AD service components is controlled by the AD users and groups summarized in Table K-2.

Table K-2 Administrative Users and Groups

Administrative Group	Associated Service	Object Type	Purpose
Administrator	Active Directory	Admin user	The Active directory administrator that has all rights to manage the Active Directory Domain
Delegated Administrator	Active Directory	Admin user	These administrators are usually responsible for administering within a specific OU. They might be assigned only enough rights to install servers or they might be assigned to specific roles. These are similar to eDirectory Container Administrators.
Domain Admins	NSS AD	AD Group	Members of this group in the domain the OES server has joined, have Supervisor rights on the AD-enabled volumes associated with those servers. A different group can be designated through the nitconfig utility or by manually editing the nitd.conf file.
OESAccessGrp	NSS AD	AD Group	Members of this group have rights to manage trustee assignments, file attributes, and so forth on AD-enabled NSS volumes as their trustee assignments allow. If the group doesn’t exist, all AD users with the required trustee assignments can perform management tasks on AD-enabled volumes.