Prevent another administrator

[rua17]

Can I prevent another administrators from changing my password?

 

[Mike Brannigan [MSFT]]

Can I prevent another administrators from changing my password?

Since that is the point to some degree of being an Administrator - then if
you need to be in a position where the ultimately cannot gain enough rights
to change your password - then they should not be Administrators.
They should be a regular account or groups that is delegated the required
permissions and rights for them to do their job.
If there job allows them to reset your password then - they can.

(Obviously you can put accounts in OUs and secure access to these OUs and
even the account and attributes - but if they are Administrators they can
ultimately gain control and reset those permissions)

This is all about TRUST. If you cannot trust your admins then they should
not be admins.

--
Regards,

Mike
--
Mike Brannigan [Microsoft]

This posting is provided "AS IS" with no warranties, and confers no
rights

Please note I cannot respond to e-mailed questions, please use these
newsgroups

 

[Joe Richards [MVP]]

Only if the admin is not very good.

 

[rua17]

OK, I want them to do the following.

Have complete control of the user workstations (install software, change
configurations, etc...)

Reset user pwds, do back-ups in the servers but not install software or
change permissions, shares, etc.

Is thera a template in wich I can do that??

Thanks

 

[Fritz Ohman]

Have complete control of the user workstations (install software, change
configurations, etc...)

Create a group 'Domain WS Admins', and use Restricted Groups in Group Policy
to put this domain group into the local Administrators group of your
workstations.

Reset user pwds, do back-ups in the servers but not install software or
change permissions, shares, etc.

You would need to set this manually. The things you have described here
would be possible with a combo of AD permissions and GPO settings.

Is there a template in wich I can do that??

Well, your question does not describe in detail what you want to do, so I
would say no, not to my knowledge there isn't.

hth,

/F