Help! to many people in my AD!

  • Thread starter Thread starter Gary Hornbeck
  • Start date Start date
G

Gary Hornbeck

Hello all,
As a network admin, I have to grant more rights than I like to for our
programmers. Problem is they have domain admin rights...is their a way I
can lock them out of AD do they have to let me know when they make changes?
Any advise or suggestions here greatly welcome...
TIA,
Gary (and no, is was not my idea to give them these rights in the first
place, but it is political now.)
 
There is no good reason a programmer should be a domain admin, unless they
are doing domain admin duties. At most they should only be admin of the
local computer.

Take their domain account out of the domain admin group and from the local
computer add their domain account to the local admin group.

hth
DDS W 2k MVP MCSE
 
Back
Top