up vote 0 down vote favorite
1
share [g+] share [fb]

there are tools out there that can prevent changes in Active Directory done by Admins.

Does anyone know, which interface is used for this?

link|improve this question
oddly enough he's correct, if DA's were perfect then tools\interfaces would not be necessary. delegation does not prevent stupid actions from taking place. netiq.com/products/cgad/default.asp – tony roth Sep 22 '11 at 14:08
@tony you can already monitor and audit all of the changes in the security logs on the Domain Controllers. That tool just simplifies it. With 2008R2, there is an Active Directory Recycle Bin that can easily recover deleted AD objects. The need for third party tools to manage AD is becoming less and less attractive. – MDMarra Sep 22 '11 at 14:19
deletions are a minor concern its poorly thought out changes that are most problematic. I usually think like you but some don't, they want and extra set of eyes on a change prior to pulling the trigger. – tony roth Sep 22 '11 at 14:24
feedback

3 Answers

up vote 6 down vote

The correct way to do this is to use Delegate Permissions in ADUC to grant only the rights necessary to give the user what they need. Everyone that has permission to do tasks in AD shouldn't be a Domain Admin. If they are, any third party tool that can change this behavior can be circumvented.

link|improve this answer
feedback
up vote 3 down vote

I'm not sure what you mean by interface, but if I didn't want someone making changes in AD, I'd take them out of the Admin groups that granted them privileges to do so.

link|improve this answer
feedback
up vote 0 down vote

You can try Adaxes, it is an Active Directory management solution. Among other features it has role-base security model and approval based workflow. These features can help you to control changes made by your staff.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.