Deny Domain Admins adding computers

I have a handful of domain admins that I want to take away the ability to
add computers to the domain while letting some keep this privilege. How can
this be easily done?

Thanks!


.

Relevant Pages

  • Re: Active directory Group Policy (Win2k)
    ... When I enforce the policy onto the computers in the new OU, ... Domain Admins so the Domain Admins cannot view ... workstations, to access Microsoft Office. ...
    (microsoft.public.security)
  • Re: Group Policy setting for restricting creation of local user accounts
    ... if DA was not in each machine's local Administrators ... group that mimics domain admins rights minus the right to create local ... being able to create accounts on the computers. ... local computer user accounts when the computer is joined to the ...
    (microsoft.public.windows.group_policy)
  • Some users unable to log into domain.
    ... Testing to slowly move over 40-50 computers to a domain.. ... I can switch back to the reduced access account and it does work ... Ive tried two logins featured under the domain admins group, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Right to add computers to a domain
    ... Domain Admins group? ... the right to join computers to a domain. ... It all began with Adam. ...
    (microsoft.public.windows.server.security)
  • Re: More on user permissions in a 2K AD domain
    ... > wanting is to keep the Domain Admins off of any workstation. ... users themselves by default can join up to 10 computers to the domain. ... > have only local console access. ... TS in admin mode is fine - if you mean in application mode, no, don't do it. ...
    (microsoft.public.win2000.active_directory)