Help! to many people in my AD!

[Gary Hornbeck]

Hello all,
As a network admin, I have to grant more rights than I like to for our
programmers. Problem is they have domain admin rights...is their a way I
can lock them out of AD do they have to let me know when they make changes?
Any advise or suggestions here greatly welcome...
TIA,
Gary (and no, is was not my idea to give them these rights in the first
place, but it is political now.)

 

[Danny Sanders]

There is no good reason a programmer should be a domain admin, unless they
are doing domain admin duties. At most they should only be admin of the
local computer.

Take their domain account out of the domain admin group and from the local
computer add their domain account to the local admin group.

hth
DDS W 2k MVP MCSE

 

[Chriss3]

as Danny says you may should put them into a security group, and make them
local admins of there own boxes only.

This article describes how to do so:
http://www.chrisse.se/MAQB.asp?ID=29