monitoring account admins

[dooby12]

we have a helpdesk team of 5, we need 3 of the members to be able to manage users in the domain, but how can we restrict them making changes to the file system, ie the need to be able to create user directories but not to be able to change the NTFS permissions on the root of the users directory.
the reason for this concernt is that one of our admin team managed to reset the permissions on the root of the users directiory to 'everyone' full control. !!"£??

 

[ebertson]

I belive that there's a special group for this type of access. Make these 3 admins' accounts members of the 'Account Operators' group. It's been a while, but I think this should work for you.