Can anyone refer to any documents on what is and is not configurable when creating a Local groups privileges?
Here is my dilemma: We are looking to deploy a custom group to all of the Servers in our domain. The purpose of this new group will be to reduce the number of accounts that are in the Administrators group on all of these machines. What I am hoping is there is a way to delegate rights to this group to do everything an Administrator can do except manipulate server security... they should not be able to create local accounts or add domain accounts to any Local Groups.
We are running into issues where once someone attains Administrator access they then give anyone else Administrator access. This is causing us some issues with audit.
any thoughts or ideas are much appreciated as I am having a hard time finding much information on others that have attempted to overcome this type of issue.
H.
Here is my dilemma: We are looking to deploy a custom group to all of the Servers in our domain. The purpose of this new group will be to reduce the number of accounts that are in the Administrators group on all of these machines. What I am hoping is there is a way to delegate rights to this group to do everything an Administrator can do except manipulate server security... they should not be able to create local accounts or add domain accounts to any Local Groups.
We are running into issues where once someone attains Administrator access they then give anyone else Administrator access. This is causing us some issues with audit.
any thoughts or ideas are much appreciated as I am having a hard time finding much information on others that have attempted to overcome this type of issue.
H.