I've been on vacation for a couple of weeks, and came back to a bit of a situation. The helpdesk staff now seem to be able to control accounts in the domain - they can set/reset passwords, disable/enable accounts, update group memberships, etc.
I've looked, and domain admins looks as expected. Am I correct in believing that the only other way this can happen is through OU delegation? If so, how do I check to see what's changed WRT delegation - how do I audit that? Kurt ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
