Re: RE: Restrict the Domain Admin

[sf_mail_sbm () yahoo com]

> .. you can split the authentication between several people (have them each type a char and put their section in a 
> safe...

Sounds good, but in practice, and in urgent situations, you have to contact all the persons holding the password... we 
have put something similar in place, and we face resistance from the operations and business guys who want a minimum 
downtime

> Any right can be assigned under Microsoft

Tried to implement this also, and found that if I do not give a user the right to DELETE a user profile, he will NOT be 
able to MOVE a user from one OU to another OU... has anyone encountered this OR better is there a solution for this...