Step 1 — Create the Contoso Service Management Administrative Delegation Model

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

The service owners create the service delegation model according to the following criteria:

• Objective: Create a delegation model to distribute service management among service administrators by enabling efficient, security-conscious delegation and distribution of administrative responsibilities among various administrative groups.

• Stakeholders: Service owners.

• Approach: Identify the number of instances of each service management role that are needed and the administrative personnel who are assigned to each role.

Service Management Roles

For the service administrative delegation model, Contoso requires the following management roles:

• Forest Configuration Operators

• Domain Configuration Operators

• Schema Admins

• Replication Management Admins

• Replication Monitoring Operators

• DNS Admins

• Security Policy Administrators

• Service Admin Managers

• Domain Controller Admins

• Backup Operators

Template for Creating the Delegation Model

Contoso uses the information in Table 14 as a template for assigning each role.

Table 14 Role Assignment Template

Assigning the Roles During Role Creation

Fields for each role are filled in by using the role template.

Assigning Forest Configuration Operators

The service owner follows the recommendation for creating only one instance of this role.

Table 15 shows the model creation entries in the template for this role.

Table 15 Model Creation Template for Forest Configuration Operators Role

Assigning Domain Configuration Operators

The service owner follows the recommendation for creating only one instance of this role per domain. Because there are three domains, three instances are defined.

Table 16 shows the model creation entries in the template for this role.

Table 16 Model Creation Template for Domain Configuration Operators Role

Assigning Schema Admins

The service owner follows the recommendation for creating only one instance of this role.

Table 17 shows the model creation entries in the template for this role.

Table 17 Model creation template for Schema Admins role

Assigning Replication Management Admins

The service owner follows the recommendation for creating only one instance of this role.

Table 18 shows the model creation entries in the template for this role.

Table 18 Model Creation Template for Replication Management Admins Role

Assigning Replication Monitoring Operators

The service owner follows the recommendation for creating only one instance of this role.

Table 19 shows the model creation entries in the template for this role.

Table 19 Model Creation Template for Replication Monitoring Operators Role

Assigning DNS Admins

The service owner follows the recommendation for creating one instance of this role for the entire forest and one instance for each domain.

Table 20 shows the model creation entries in the template for this role.

Table 20 Model Creation Template for DNS Admins Role

Assigning Security Policy Administrators

The service owner follows the recommendation for creating one instance of this role.

Table 21 shows the model creation entries in the template for this role.

Table 21 Model creation template for Security Policy Administrators Role

Assigning Service Admin Managers

The service owner follows the recommendation for creating one instance of this role.

Table 22 shows the model creation entries in the template for this role.

Table 22 Model Creation Template for Service Admin Managers Role

Assigning Domain Controller Admins

Contoso implements two instances of the Domain Controller Admins role. One instance is based in Chicago and is responsible for managing all domain controllers that are located in Chicago and for remotely managing all domain controllers that are located in the other two sites in North America. Similarly, one instance of the Domain Controller Admins role is based in London and is responsible for managing all domain controllers in the London site and for remotely managing all domain controllers that are located in the other two sites in Europe.

Contoso has implemented RILOs in remote sites so that all aspects of their domain controllers can be managed remotely from the hub site. The only operation that cannot be performed on RILO-based systems is physically starting and shutting down the domain controllers in a remote location. For this administrative operation, one local administrative group is assigned the responsibility for shutting down and starting domain controllers when needed.

Table 23 shows the model creation entries in the template for this role.

Table 23 Model Creation Template for Domain Controller Admins Role

Assigning Backup Operators

According to the recommendations for this role, there should be one instance for each domain. Although there are three instances of this role in the model, the service owner decides to assign the same group of administrators to each of the three instances. The administrators in this group are all located in Chicago. This one group is responsible for backing up Active Directory for all three domains. Table 24 shows the model creation entries in the template for this role.

Table 24 Model Creation Template for Backup Operators Role

Service Role Assignment Summary

Table 25 provides a summary of the roles and instances that have been assigned for service management.

Table 25 Summary of Assigned Contoso Service Management Roles

Now that the creation phase is complete, Contoso has a delegation model that documents the division of responsibility for service management of the Active Directory infrastructure. In the next step, the Enterprise Admins group will implement the Active Directory directory service management model.