Reducing dman admins

Hi guys we are tasked with trying to reduce the number of domain admins in our network.
Let's say we have A list of 30 users who are members of domain admins.
How could we identify if these users have not performed a task that requires domain admin membership in the past 6 months?
By doing something like this, we could justifying removing these users from the domain admin group.
Thanks everyone.
LVL 1
Simon336697Asked:
Who is Participating?
 
Mike KlineCommented:
It would be hard to go back in time and figure out everything they have done in 6 months.

What I've done in the past is reach out and ask,  what do you do in your daily job, then figure out why/if they actually need DA rights or can the rights be delegated.


Very worthwhile project, not always easy to reduce, and can get political/personal.

Thanks

Mike
0
 
SandeshdubeySenior Server EngineerCommented:
The best practice is to find the number of user who requires domain admin rights for certain activity.
why they require and how many times they required in a month and for what activity?

If the activities are realated to desktop you can right away remove the domain admin rights and add the user to their local desktop administrator group as per requirement.Refer www.globalimaginginc.com/resources/docs/AddingLocalAdministrator.doc

It is not best practise to have n nos of domain admin in the environment.
0
 
Simon336697Author Commented:
Thanks so much guys sorrry about the delay.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.