We have an AD forest with the standard root domain and various sudomains. IT personel sit in the root domain. I need to give a user account domain admin rights on each sub domain. I will not give them enterprise admin rights or domain admin rights on the root domain.
I tried a combination of placing Domain Global groups into Forest Universal groups and placing the domain admin for each domain in the domain global groups. But I think I got that wrong as I got turned around on where to place the actual user account.
The goal is to give junior admins the right to login to subdomain Domain controllers and Full AD access to the subdomains, but they will not have these same rights in the root domain for the forest. I am trying to avoid delegation in AD users and Computers by using the default built in users and groups of AD.
I will continue to work on this, just curious how others are doing it.