Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

there are tools out there that can prevent changes in Active Directory done by Admins.

Does anyone know, which interface is used for this?

share|improve this question
    
oddly enough he's correct, if DA's were perfect then tools\interfaces would not be necessary. delegation does not prevent stupid actions from taking place. netiq.com/products/cgad/default.asp –  tony roth Sep 22 '11 at 14:08
    
@tony you can already monitor and audit all of the changes in the security logs on the Domain Controllers. That tool just simplifies it. With 2008R2, there is an Active Directory Recycle Bin that can easily recover deleted AD objects. The need for third party tools to manage AD is becoming less and less attractive. –  MDMarra Sep 22 '11 at 14:19
    
deletions are a minor concern its poorly thought out changes that are most problematic. I usually think like you but some don't, they want and extra set of eyes on a change prior to pulling the trigger. –  tony roth Sep 22 '11 at 14:24

2 Answers 2

The correct way to do this is to use Delegate Permissions in ADUC to grant only the rights necessary to give the user what they need. Everyone that has permission to do tasks in AD shouldn't be a Domain Admin. If they are, any third party tool that can change this behavior can be circumvented.

share|improve this answer

I'm not sure what you mean by interface, but if I didn't want someone making changes in AD, I'd take them out of the Admin groups that granted them privileges to do so.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.