Solved

Prevent Domain Admins From Modifying Domain Admins Group

Posted on 2013-05-29
1
349 Views
Last Modified: 2013-05-31
I am looking for a way to prevent Domain Admins from adding to the Domain Admins and Administrators Groups iin one of our Child Domains.

I only want Enterprise Admins to be able to add to this Group

I have given certain users "Delegative Access", but some users have to be Domain Admins

Whats is the best way to do this.
0
Comment
Question by:oasisuk
1 Comment
 
LVL 22

Accepted Solution

by:
Haresh Nikumbh earned 500 total points
ID: 39204297
Domain admin.

Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain workstations, and all domain member servers at the time they are joined to the domain. By default, the Administrator account is a member of this group. Because the group has full control in the domain, add users with caution.

so i dont think so you can stop them, the  only option is create another group and give as per your required rights and add those members in that group.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows 10 and WSUS 3.2 5 79
GPO and server 2008 R2 7 34
Server running out of memory - Something is consuming all the available memory 17 55
NTFS Permissions 6 42
Normally after a failure of Domain Controller, when promoting new DC the DC is renamed, we will discuss the options in Dcpromo to re-create the DC with the same name. Scenario: You are a small IT shop with two Domain Controllers (Domain Contr…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question