Deny "Add new User/Account"

[eXtremer]

Hi all.
How to make in such a way that nobody logged on the workstation could create a new user, not even the Administrator or any user of the Administrators Group.
NOBODY.
I know it's possible but I can't find wanted info on the net...maybe the "search keys" are not right.
Waiting for a reply, thanks in advance.

 

[GrimR]

I was thinking make another user account to login with, set them as a user or power user, for the administrator, type out a ridiculous password like a MS key, then burn the paper. But then again anyone with a winternals disk could just reset it, so format it and burn it through it in the bin.

 

[wolluf]

There's no way you can do this - as any member of the Administrator's group can always undo anything (though you could make it difficult to undo). And basically its a daft requirement - you really should password protect the Administrator account and make sure all other users have not got access to create user feature. Ie, the o/s is designed to have at least one account to administer it!