Re: Restrict the Domain Admin

[Christos Triantafyllidis <ctria () physics auth gr>]

sf_mail_sbm () yahoo com wrote:
> Hi List,
> Is there a way to restrict access of a Domain Admin?
Nope.
> Example, can we allow a Dommain admin to do everything EXCEPT user management (e.g. password reset)? 
This won't be a "Domain admin"
> We want to secure our environment, and do not want to have "ALL-POWERFULL" domain admins around
>
> Thanks for your suggestions
>
> P.S. Environment: Windows (2000 & 2003) - Active Directory

The best you can use is limit your domain admin account to the people 
that should be domain admins. Add a new custom group for each privilege 
that Active Directory allows you to have, and make users members of the 
groups they should be.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature