Windows Forum

Ask something
Discussion Locked

Active directory built-in group security

0 helpful
1 reply

by gdemoura

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

We`re currently using Windows 2000 server and active directory. I would like my local administrators to be able to install program on servers (including DC), administer OUs without being on the built-in Administrators group. Indeed, they can add themselves to the "Domain Admin" group.

How can I prevent that?

1 reply

by p.j.hutchison

Remove the users from Administrators and Domain Admins groups.
Create a new group in AD called SERVER_ADMIN_USERS, add the users to that then add that to the local Administrators on each server.
Apps can only be added to a DC by Domain Admins only so I suggest s/w to be dealt with seperately for those servers.

This discussion is closed to new replies.