Check the Account Operators group?

-----Original Message-----
From: Kurt Buff [mailto:[EMAIL PROTECTED] 
Sent: Monday, May 05, 2008 10:30 AM
To: NT System Admin Issues
Subject: Domain Admin monkey business

I've been on vacation for a couple of weeks, and came back to a bit of
a situation. The helpdesk staff now seem to be able to control
accounts in the domain - they can set/reset passwords, disable/enable
accounts, update group memberships, etc.

I've looked, and domain admins looks as expected.

Am I correct in believing that the only other way this can happen is
through OU delegation? If so, how do I check to see what's changed WRT
delegation - how do I audit that?

Kurt

~ Upgrade to Next Generation Antispam/Antivirus with Ninja!    ~
~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm>  ~

~ Upgrade to Next Generation Antispam/Antivirus with Ninja!    ~
~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm>  ~

Reply via email to