Can administrator privileges be limited

[Hemlock tree]

On a pc using xp ,
can the pc administrator account have limited privileges?
If the privileges are limited, how does the admin get them back?

I have seen several postings that say they are using Admin but don't
have the privileges to install software or add a printer.

Is there a tool that will limit administrator priveleges on a
network?

TIA,

Hemlock

 

[Roger Abell]

Administrators cannot be truely limited.
Administrators like any other account are subject to
permissions checks on NTFS area and reg keys, and
need to have some things explicitly granted to them.
Administrators however differ in that they can always
find a way to make the grants when they do not exist.

The sometimes seen messages about not being an admin
etc in order to install . . . are usually errors in applications
and how they interpret certain key info.

 

[Colin Nash [MVP]]

Usually people approach this from the other direction: take a regular
account and give it a *few* special rights to do certain things.

For example, Active Directory has greatly improved on this and made it a lot
easier as opposed to the NT-style of domains.

 

[Marco]

Administrastors cannot be limited: there are a few group policies that
attempt to restrict what admins can and cannot do but the members of the
local administrators account have the ability to override any policy.

We have taken another path: if interested follow the url here below.

 

[Guest]

Hemlock tree,

Adminstrator can be limited using third party software. There is a secuirty package call Seos that runs on Windows NT, and many UNIX variants. It can been administrated remotely and has many powerful features to limit what an Administrator or "root" user can do. The company that originally wrote the product was purchased by Computer Associates a couple of years ago but product information can be found here: http://www3.ca.com/Solutions/SubSolution.asp?ID=4348

-David L. Bork
(Bork Technical Services)