RE: [ActiveDir] Restrict Administrative Privileges

[Roger Seielstad]

Title: Message

Yeah - don't make the user a Domain Admin. Use proper delegation of rights and its not an issue.

 

 

--------------------------------------------------------------
Roger D. Seielstad - MTS MCSE MS-MVP
Sr. Systems Administrator
Inovis Inc.

-----Original Message-----
From: Stuart, Cory G. [mailto:[EMAIL PROTECTED]
Sent: Monday, February 16, 2004 12:26 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Restrict Administrative Privileges

Hi All,
        Is there a way to deny password changing abilities to a Domain Administrator for only a limited set of accounts?  These accounts reside in their own OU, which because of the permissions set, that Domain Admin cannot even see it when in ADUC.  I thought that my problem was solved.  I just found out that this Domain Admin can still use DSMOD to change passwords of users within that OU.  Any help is appreciated!

Thanks!!

Cory

-----------------------------------
Cory G. Stuart
Network Administrator
Nuclear Engineering Division
Argonne National Laboratory
-----------------------------------