Domain Admin Group Security

[dazzabroughton]

We are trying to lock down security in our network. One of the key things is to try and stop certain members of IT from adding or removing anyone from the Domain Admins security group.

I've achieved this on other groups by setiing the deny write property to the IT group on the security tab of the properties of the group, and this works fine, the add/remove members button is greyed out, which is what I want.

But when I try exactly the same thing on the Domain Admins group, it works for about half an hour, and then is automatically reset back to the way it was. Anyone any ideas how I get it to keep the security settings I want.

Thanks

 

[mlichstein]

You would need to change the ACL on the AdminSDHolder object in AD. Every hour, AD checks the ACL on AdminSDHolder and resets several important objects in AD to mirror that ACL.

More info on AdminSDHolder:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q318180

 

[dazzabroughton]

Excellent thanks for that, it clears it up for me.