Re: Change permissions for domain administrators group

changing permissions or configurations to prevent domain admins or administrators from doing things, is just a waste of time. Members of either group can do whatever they want and therefore also undo what you have odne

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------

"Jason Murray" <JasonMurray@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:810667BE-5A9E-4866-BFAE-C5312D8251F3@xxxxxxxxxxxxxxxx
Hi All,
I need to change the rights for the domain administrators group. The rights
changes involved granting 'Adjust memory quotas' to nobody;.
Does anybody know how i can do this? Is this a standard security permission
or do i need to go through group policy?
Thanks
Jason

.

Relevant Pages

  • Re: Settle a Administrators dispute
    ... if a user is in Administrators or Domain Admins they can give themselves as much rights as they want in the forest. ... Our disagreeable admin says that if a Global Group is put into the Administrators Local Group on the DC but not in the Domain Admins Global Group, the users of the Global Group do not have the same permissions as the Administrator account -- particularly to add/modify/delete user/computer/group accounts in AD. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Settle a Administrators dispute
    ... I wasn't saying that administrators couldn't add themselves to other groups. ... I was saying the original question was a moot point because both admins and domain admins can give themselves as much rights in the forest as they want so even if someone took some rights away from the administrator account, you didn't actually stop anything because they can just give those rights back. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain Admin Share
    ... Domain Admins have special rights to the domain by default. ... Administrators only have rights to the DC. ... I believe that only the NT Domain Admins have that right by default. ... Domain Admins group to the NT Domain Admins group. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ACL Issue - Easy Question
    ... The problem is they need full rights to work on the DC because they are the ... >> either themselves or other people to the Domain Admins or Enterprise ... >> Administrators groups set of permissions. ...
    (microsoft.public.win2000.security)
  • RE: software to control domain administrators
    ... "Does anyone know any software to control, audit, or restrict access or privileges to domain administrators." ... I will restate my mantra differently, If you can not trust someone to be in a position of complete un-adulterated control of your network, then they should not be in that position. ... >(assuming we are talking about NT/AD Domain Admins) ...
    (Security-Basics)