How to restrict adding users to the Admins Group

[wchull]

We have an unusual situation that we are looking for a solution to. By default, anyone in the Administrators group can add other local accounts and global accounts to the local Administrator's group. What we want to do is restrict that default functionality so that only a single local administrator's account and members of a specific global administrator's group are allowed to add anyone else to the local administrator's group. If anyone has done this or has any idea's on how it might be accomplished, please let me know. Thanks!

 

[Roadki11]

Best way i can think of is to use Restricted Groups, see the following link:

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen