Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 226
  • Last Modified:

Removing the ability to delete an OU

I have a account called Dameware Admins and it was created by someone else and granted way to many permissions.  I need to remove the right to delete or create an OU in AD, also the ability to delete Groups out of AD.  How can I reconfig this account without having to create a new one?
0
Klint_turney
Asked:
Klint_turney
  • 2
1 Solution
 
mikeleebrlaCommented:
i assume this account is in the domain or enterprise admin group?  if so, simply remove it from these groups and then assign it whatever permissions it NEEDS to do whatever the account is used for.

whoever setup the account just gave it blanket domain admin access b/c that was the easiest way to set it up.

0
 
Klint_turneyAuthor Commented:
If there is audit enabled how do I view the logs?  Aren't they in Event Viewer- Security?

Also you delete something from a OU wouldn't that show only on the DC you're auth to?
0
 
mikeleebrlaCommented:
hold up, your initial question asked how you remove the ABILITY to delete groups, etc etc, now you are talking about auditing and event logs.....

which do you want? a how to for permissions, or a how to on logging events?  b/c your initial question mentioned nothing about logging/auditing.

but yes, whatever you HAD logging turned on for will show up in the security section of the event viewer.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now