Prevent shutdown by domain administrator

[Peter CCH]

Is there any way to prevent the PC to be shutdown by domain
administrator if my PC is in the domain?

 

[Pegasus \(MVP\)]

Is there any way to prevent the PC to be shutdown by domain
administrator if my PC is in the domain?

No, because he is "omnipotent".

 

[Peter CCH]

OK.

Then can I block domain administrator from access some of my personal
files?

 

[Dan Seur]

Sure, just don't keep them on that computer.

 

[Peter CCH]

Weird, cause I encounter a situation which the domain administrator
unable to access to some directory of the PC after joining the PC into
domain.

We perform all this in the PC1:
1. There's one PC (PC1), previously is under workgroup, then we join
PC1 into domain (DomainA).
2. After that we restart the PC.
3. Login to domain with new user (to let windows create the directory
structure)
4. Logoff
5. Login to domain with domain administrator account
6. Try to copy over previous user profile into the new user profile.

Result: FAIL

Reason, files in previous user is not accessible by domain
administrator.
I have to logoff and login locally (not logon to domain) with previous
user name.
Then manually set read and write access for domain administrator on the
previous user profile directory. Then login with domain administrator
again to copy the profile over, and this time it success.

I was thinking, since domain administrator can access to any file in
any PC that's joined to domain, how come it can't access to the files
of previous user profile.

Any idea?



Peter CCH

 

[Torgeir Bakken \(MVP\)]

Weird, cause I encounter a situation which the domain administrator
unable to access to some directory of the PC after joining the PC into
domain.

We perform all this in the PC1:
1. There's one PC (PC1), previously is under workgroup, then we join
PC1 into domain (DomainA).
2. After that we restart the PC.
3. Login to domain with new user (to let windows create the directory
structure)
4. Logoff
5. Login to domain with domain administrator account
6. Try to copy over previous user profile into the new user profile.

Result: FAIL

Reason, files in previous user is not accessible by domain
administrator.
I have to logoff and login locally (not logon to domain) with previous
user name.
Then manually set read and write access for domain administrator on the
previous user profile directory. Then login with domain administrator
again to copy the profile over, and this time it success.

I was thinking, since domain administrator can access to any file in
any PC that's joined to domain, how come it can't access to the files
of previous user profile.

The domain administrator would need to take ownership first on
those folders/files to be able to access them.