I'm working on secure a Windows 2003 domain with 50 clients. The fist task where I'm working on is to remove technical support staff from the Domain Administrator group. But, I need that they can still:
- Unlock User Accounts -> Done
- Operate Servers (backups and reset) -> Done
- Operate Printers -> Done
- Troubleshooting workstations -> ! CHAN !
I was thinking to add a Domain Local Group named "Support" to "Local Administrator" group on each workstation, what do you think about this approach?