Administering your Active Directory (AD) environment is easier and more secure with a couple of built-in Windows 2000 options: the Delegate option and the Runas command. The Delegate option lets you specify a user to manage an object. This option is great because you can have separate administrators for groups or items within your AD setup, which can take some of the administrative load off of you. Delegate is particularly handy when you have multiple offices or groups in separate areas or time zones, because having a central administrator for all groups is inconvenient in those cases. To delegate control of an object, open the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in, right-click the object you want to delegate, then select Delegate. A wizard will guide you through delegating management of an object.
The Runas command, previously available only in the Microsoft Windows NT Server 4.0 Resource Kit, will be familiar to UNIX and Linux users. Runas lets you give a regular user account administrative access when issuing a command. Runas can help minimize the number of times you must log on and off to perform administrative duties. You can use Runas to open various utilities or applications with administrative access without having to directly log on as the administrator, thereby minimizing the chances of attackers discovering the Administrative account password. To get the syntax for the Runas command, click Start, Run, then type
cmd.exe
and click OK. In the command prompt window, type . . .
