Restrict Permission of Enterprise-Admin

[J. Stolz]

Hello,

There is a root-domain .global and two sub-domains
us.global and de.global . Is it possible to Restrict the
permission of the Enterprise-Admin? We don´t want the
Enterprise-Admin to have full permission to administrate
the sub domain de.global. If this can be done, then would
be the Enterprise-Admin able to give himself full
permission to administrate a certain or all sub-domains?

Thanks in advance,
J. Stolz

 

[Shawn Rabourn \(MS\)]

Enterprise admin is God. If you take away from him, he will be able to get
back. Try using a split password for the Enterprise Admin account (change
the password with your domain admins in the room and have each admin supply
one piece of the password) and giving only domain admin permission to each
person.

--Shawn
This posting is provided "AS IS" with no warranties and confers no rights.


Hello,

There is a root-domain .global and two sub-domains
us.global and de.global . Is it possible to Restrict the
permission of the Enterprise-Admin? We don´t want the
Enterprise-Admin to have full permission to administrate
the sub domain de.global. If this can be done, then would
be the Enterprise-Admin able to give himself full
permission to administrate a certain or all sub-domains?

Thanks in advance,
J. Stolz

 

[Joe Richards [MVP]]

Any admin in any domain can get control of your entire forest. All admins should be fully trusted across the entire
forest.

--
Joe Richards
www.joeware.net

--

Hello,

There is a root-domain .global and two sub-domains
us.global and de.global . Is it possible to Restrict the
permission of the Enterprise-Admin? We don´t want the
Enterprise-Admin to have full permission to administrate
the sub domain de.global. If this can be done, then would
be the Enterprise-Admin able to give himself full
permission to administrate a certain or all sub-domains?

Thanks in advance,
J. Stolz