Re: Domain Admin group in ISA 2006

If you can't trust the Domain Admins then the war is already over and you lost.
ISA would be the last thing you have to worry about.
Don't give people Domain Admin privledges if they can't be trusted at that
level,...there are *other* ways to delegate the abilities to do the work they
need.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft, or
anyone else associated with me, including my cats.
-----------------------------------------------------


"Paul" <guardian911@xxxxxxxxx> wrote in message
news:uge24350avqp16omk1trbokq64dkd4112r@xxxxxxxxxx

I keep reading that one of the downsides of having ISA 2006 joined to the
domain is the fact that any domain admin can
compromise the ISA array configuration.

Isn't it easy enough to remove the Domain Admins security group from the local
administrator group on the ISA Server and
subsequently remove Domain Admins from having the ISA Server Full
Administrator role?

Unless there is some Group Policy in effect, the Domain Admins should not be
able to add themselves back, correct?


.

Relevant Pages

  • Re: Website restrictions
    ... you should install firewall client and set the all user required ... authenticating) and will override anything else. ... Then use Domain Admins and UserA in a different User Object created ... in ISA for the "exception". ...
    (microsoft.public.isa)
  • Domain Admin group in ISA 2006
    ... I keep reading that one of the downsides of having ISA 2006 joined to the domain is the fact that any domain admin can ... Isn't it easy enough to remove the Domain Admins security group from the local administrator group on the ISA Server and ... subsequently remove Domain Admins from having the ISA Server Full Administrator role? ...
    (microsoft.public.isaserver)
  • Re: Website restrictions
    ... You are better off adding Domain Users to the User Object you created in ... Then use Domain Admins and UserA in a different User Object created in ... ISA for the "exception". ... Microsoft Internet Security & Acceleration Server: Partners ...
    (microsoft.public.isa)
  • Rights to Install ISA 2004
    ... Can group of Domain Admins perform installation of ISA 2004? ... something like prevent me to install ISA 2004 when I join the server to the ... ISA 2004 Std sits on Win 2003 Std. ...
    (microsoft.public.isaserver)
  • Re: ISA server authentication problem!!!!HHHEEEELLLLPPPPPPP!!!!
    ... Is your ISA server member of that domain? ... > authenticate domain user on firewall client.All domain admins can corectly ... > AUTHORITY\SYSTEM ISASERVER "Logon Failure: ... > Caller User Name: - ...
    (microsoft.public.isaserver)