Remote Plant Manager Administrative Logon

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I have a plant manager at one of our remote sites that has managed to
convince the powers that be, against my reccomendations, that he needs to be
able to logon to the server at his plant (Server 2003 Std, DC, GC, DFS
Replica Partner) it's a small plant with less then 10 users so this is the
only server. This plant is tied into the main corperate network via VPN, so
to give him access to this server, means network wide access.

I have tried to implement "Hack 74" from O'Reilly's latest Windows Server
Hacks (http://www.oreilly.com/catalog/winsvrhks/chapter/hack74.pdf) but when
I try to logon to the server as a "AD restricted user, I get an access
denied error... I have tried to change various permissions settings for the
restricted user group, but am having no luck getting things to work
correctly.

I am seeing very odd permissions being deligated throughout the system. For
instance, I set nearly everything but a few read permissions, to deny at the
top level of AD for this group, and set it to apply to this object and all
child objects, when I look at the effective permissions, everything is
correct except for no matter what I do, I can not get it to deny the modify
permissions property. when I drill down to the main OU that contains all the
remote plant accounts, I look at another effective permission, and it shows
that the same user account, which is a menber of the restricted group, has
full controll when looking at the effective permissions.

The way it looks, the explicit deny entries are getting overwritten by the
Domain Admins group explicit Allow Permissions (the restricted admin group
is a member of the domain admin group). why would an explicit deny, not take
precidence over a transitavly inherrited explicit allow? it does everywhere
else!

has anyone actually implemented this, or any similar restriction for a
remote office before? if so, how did you do it, and what problems did you
run into?