Administrator Rights

[Guest]

Okay, so I know most security options in a Workgroup is so much limited, but
is there somewhere I can prevent another "Administrator" user from being able
to change another "Administrator" user's password?

I was able to prevent this other Administrator accounts fromaccessing the
folders and accounts of other Administrator accounts. However, I was looking
for a further way to restrict/prevent administrator users from, say, changing
the password for other Administrator users.

Is it possible to prevent "A-Administrator user" from changing the password
for "B-Administrator user"?

I hope this will be possible because I have other people sharing my PC with
me, but they are savvy enough to go through Computer Management> Local
Users/Groups and Right-Click on my PC to "Reset Password"

 

[Steven L Umbach]

No that is not possible. It also is not possible to restrict a knowledgeable
administrator from accessing folders on the computer that they do not have
permissions to. A skilled administrator will backup the data folders and
then restore the data to another computer to access files without other
users even knowing it happened. If you can not trust a user do not let them
be a local administrator. A local administrator could even access EFS
encrypted files by making himself a Recovery Agent on the computer.

Steve

 

[pitsnake]

No that is not possible. It also is not possible to restrict a knowledgeable
administrator from accessing folders on the computer that they do not have
permissions to. A skilled administrator will backup the data folders and
then restore the data to another computer to access files without other
users even knowing it happened. If you can not trust a user do not let them
be a local administrator. A local administrator could even access EFS
encrypted files by making himself a Recovery Agent on the computer.

Steve

Well..... you can't really stop them if they're savvy, but you could
create a separate group like the power users and then create a local
security policy that restricts some of the functions for that group...
not really sure if you can disable password changes though.. I know you
can for computer accounts, but not sure on user accounts.