We are using taskpads to delegete tasks(such as reset password) to remote admins; the delegation is done at the OU level ; but unfortunately OU contains some special accounts/groups(such as application accounts and admin groups which is by design) ; we dont want remote admins messing with them. Is there any way to make those groups and user account inaccesible to remote admins eventhough they are delegated at OU level?
->It would be better if we can me them invisible to the remote admins but i dont think its plausible. ->Those accounts/groups cant be moved out of the concerned OU
Please give your sugesstions, let me know if any questions or clarifications.