In scenarios like this, your fallback is auditing, reporting and reprecussions. It's why they count how many missiles you fire when you're flying around in a fighter jet ;o) If you don't have that, they'll do what they want. a
________________________________ From: William J. Robbins [mailto:[email protected]] Sent: 30 September 2010 13:05 To: NT System Admin Issues Subject: Re: Restricting groups in Active Directory The short answer is yes, if they are domain admins they can do anything they like provided they have the knowledge. Including add themselves to the Enterprise Admins group since you said you were in a single domain, which I interpret as no "empty root." You could change the ACL's, but again they can undo that with the knowledge. The help desk!? Seriously? Well good luck to you in the new position, sounds like you may need some. WJR - from my Crackberry. "If you find yourself in a fair fight, your tactics suck." ________________________________ From: James Rankin <[email protected]> Date: Thu, 30 Sep 2010 12:49:52 +0100 To: NT System Admin Issues<[email protected]> ReplyTo: "NT System Admin Issues" <[email protected]> Subject: Restricting groups in Active Directory I've just started a new job and we're building an all-new infrastructure. One of the key things I'm looking at it is restricting access to the most sensitive functions of some of the infrastructure, mainly in VMWare and XenApp. I'm currently looking at doing this by using AD groups - creating groups for each support team and adding those groups to the relevant areas in XenApp and VirtualCenter to give them the necessary permissions. However, the business are adamant that every member of the support teams (from helpdesk upwards) will be given a Domain Admin account. Am I right in assuming this means that they could simply add themselves into the groups I am setting up, because even if I restrict these groups via an ACL, they could just take ownership of the group? Could I edit the ACL for these groups and Deny Domain Admins the Modify Ownership privilege? Or can they override that as well somehow? Is there some way I could handle this even if everyone gets given Domain Admin access, or will I have to convince them to do things *properly* using delegation of privilege? All input is welcomed, TIA, JRR -- "On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question." ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ************************************************************************************ WARNING: The information in this email and any attachments is confidential and may be legally privileged. If you are not the named addressee, you must not use, copy or disclose this email (including any attachments) or the information in it save to the named addressee nor take any action in reliance on it. If you receive this email or any attachments in error, please notify the sender immediately and then delete the same and any copies. "CLS Services Ltd × Registered in England No 4132704 × Registered Office: Exchange Tower × One Harbour Exchange Square × London E14 9GE" ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
