stop local server admins loading MMC + AD plugins ?

[scott]

Hi,

I setup a SQL server 2000 on a 2k member server on a 2k AD domain. I need
developers to have "local" admin rights when they login but dont want them
to be able to load the MMC console and add AD User + Computer plugin.

Is this possible ?

Thanks
Scott
stop local server admins loading MMC + AD plugins ?

 

[Steven L Umbach]

Local administrators are a very powerful group and you can hide things from them but
a malicious user will be able to find ways around most restrictions. Having said that
you can use Group Policy to restrict mmc snapins to "domain users". Note that domain
user configuration will NOT apply to local user logons. You can also configure Local
Security Policy via gpedit.msc but it will apply to all local users and a local
administrator could possibly reverse the changes. Anyhow the settings you want are
under user configuration/administrative templates/Windows Components/Microsoft
management console. You could create an Organizational Unit for those uers. Then
create a new GPO for the OU with your restrictions in place and then add those users
to the OU. --- Steve