|
Posted by Roger Abell [MVP] on April 4, 2006, 9:29 am
Please log in for more thread options There is no requirement that the adjustments of machine local groups
that happen as part of domain join must be retained. You are free to
remove Domain Admins from the machine local Administrators, and
Domain Users from Users, etc.
However, seeing the need for this is perhaps a symptom that you
do not have the correct people as Domain Admins. Doing this does
no limit Active Directory itself. It does limit some products that could
make use of Active Directory and certainly this does destroy the ability
of Domain Admins to configure and safeguard the whole domain.
> Situation:
> DomainControllerA was a domain controller of domain TEST.
> WorkStationB joined the domain TEST.
>
> Then , Administrator of DomainControllerA became a member of
> Administrators
> of WorkStationB, it possesed the whole control of WorkStationB.
> It seems to me that Administrator of DomainControllerA gained too much
> power.
> How to fix it and retain the power of Active Directory?
> Or what article I should read first?
> Thanks
> Ajang
>
| 
XML Sitemap