I am the IT manager for a small company with a 2000 AD and about 40 PCs. I have one guy that works with me who is basically help desk. He is also my backup when I am away. Our company has grown over time, but we still manage everything ok. I do not consider myself an expert when ti comes to AD at all. Right now we both log into all server using a Domain Admin account. We both use the same complex password and I really don't see any other way around it. I could limit him on some things but he is my backup when I am gone. If I had a large IT department I would greatly consider doing this. As it is now he sets up and removes users in AD. Am I going about this wrong to give him the same access as me? He has worked here for 3 years, is a life long friend that I trust.
We have always managed user's password. We have always changed them every 6 months and required them to be complex. I am entertaining the idea of handing that over to the users and modifying the security policy on the DC to make them change passwords every 60 days and require complex passwords. The issue is we can still log into their computers using the domain admin account and could get access to all their files etc and I don't think we should be able to do that. We still need to install programs and update the computers. Is there a way to do this and restrict out access from their files?