Re: Prevent changes to Administrator password

Hello Taz1972,
You should only need a couple of users with DA rights. I worked previously for a company of 50,000+ and we had 4 (Yes 4) DA's. Just because someone wants something and they want it quick doesn't mean you have to respond quickly. In other words less DA's will put a greater emphasis of certain work on a few people, that is normal. Re-Evaluate your situation and fix it instead of trying to figure out a bandaid approach.


--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4


http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This posting is provided "AS IS" with no warranties, and confers no rights.



Hello,

I administer a server 2003 AD domain which spans many sites across the
globe. Problem is there are too many people who knew the root
administrator password (which contains enterprise admin rights), so I
decided to change the password. I then gave the other admins new
accounts with just domain admin rights so they have just enough rights
to do their jobs. They do not need enterprise admin rights.

The problem is that the other admins can change the root administrator
password at their leisure, and this is not what I want them to be able
to do!

How can I prevent then from changing the password of the root
administrator account? Is there a registry hack or GPO setting that
can do this? Is this even possible to prevent?

Hopefully there is some way to solve this, and I would greatly
appreciate your quick advise.

Thank you,
Admin


.

Relevant Pages

  • Re: Registry hack to disable password change
    ... anyone with admin rights could go in and make the change back to ... someone is an administrator, they can do whatever they want to ... they have administrative rights on the computer - other than encryption - ...
    (microsoft.public.security)
  • Re: Granting all users Admin Rights
    ... reloads their own machines, ... I think I would try to find the real reasons behind why the management is ... > rights on their machines. ... In my last company I was forced to give> admin rights to most users so they could develop and install hardware> on their local machine. ...
    (microsoft.public.win2000.security)
  • Re: how to set up no need for ability to handle multiple users on machine
    ... am running always, not as admin, but as user having admin rights. ... Which is lesser rights than root. ... SUSE is Linux and for many Linux applications default document folder is ...
    (alt.os.linux.suse)
  • Re: Granting all users Admin Rights
    ... Giving users in an environment that big Admin rights is asking for trouble. ... Even worse any closet hacker wanabee would install Lophtcrack and pull up ... > I am a Network Admin for Cuesta College and we are dealing with the same ...
    (microsoft.public.win2000.security)
  • Re: Windows Client and Server Security
    ... I am working as a System Administrator in ... > these Computers. ... > He thinks that we should give all the Users, Administrator rights. ... If you have badly-written software that requires local admin rights, ...
    (microsoft.public.win2000.security)