Re: Restrict the Domain Admin

[Pete Hunt <lists () ninjafriendly com>]

sf_mail_sbm () yahoo com wrote:
> Hi List,
> Is there a way to restrict access of a Domain Admin?
>
> Example, can we allow a Dommain admin to do everything EXCEPT user management (e.g. password reset)? 
>
> We want to secure our environment, and do not want to have "ALL-POWERFULL" domain admins around

Er, that's the whole point behind a domain admin account.  They have 
root.  Anything you do to restrict them, they can undo.

This was discussed recently here: 
http://www.securityfocus.com/archive/105/397137
http://www.securityfocus.com/swsearch?sbm=%2F&metaname=alldoc&query=software+to+control+domain+administrators&x=0&y=0

The gist is "Prevent the use of domain admin accounts where such a level 
of access is unnecessary.  When domain admin access is necessary, choose 
trustworthy domain admins and log and audit their activities".

Pete