Grant Full Administrative Rights Except to change Administrator Account

[Guest]

Hi,

I'd like to set up a user on my local machine who has all the rights of an administrator, but cannot change the password (or any other aspects) of the Administrator account. Is this possible?

I know that the Administrator account doesn't show up on the Users control panel tool, but a user can still change it in the Computer Management tool.

Thanks.

 

[Steven L Umbach]

That is not possible. An administrator is all powerful on the computer by design and
must be a trusted individual. You can try to restrict an administrator, but they
ultimately have the power to reassign themselves rights and permissions [assuming
they know how]. You may want to consider making them a power user instead. You can
use gpedit.msc to hide Computer Management, but it will apply to all users on the
computer by default. --- Steve

Hi,

I'd like to set up a user on my local machine who has all the rights of an

administrator, but cannot change the password (or any other aspects) of the
Administrator account. Is this possible?

I know that the Administrator account doesn't show up on the Users control panel

tool, but a user can still change it in the Computer Management tool.

 

[Guest]

Thanks. Then how would I go about creating a new user group that has all the admin rights without the ability to change administrator accounts but can still run updates on the OS, etc.? Essentially, a power user with more rights but not able to change any administrator accoutns?

 

[Steven L Umbach]

You can't. You can configure Update to run by schedule [last option] and the logged
on user does not have to be an administrator. For other tasks, look in Security
Policy /user rights where you can give a user more power for limited number of tasks
and you can make them members of built in groups that will also allow them to perform
certain tasks such as Network Configuration Operators that will allow a regular user
to manage network connections and tcp/ip properties. --- Steve

Thanks. Then how would I go about creating a new user group that has all the admin

rights without the ability to change administrator accounts but can still run updates
on the OS, etc.? Essentially, a power user with more rights but not able to change
any administrator accoutns?