Really need help with this.
I need to allow someone else to be administrator for client computers and servers but not for domain controller.
I was able to do that but whatever I do that user is allways part of administrators group and can logon to DC, create OU etc.
- create domain user (TestAdmin)
- create group (LocalAdmins)
- add user to group (then make group primary and remove user from Domain Users group)
- create GPO (gpoLocalAdmin)
- edit policy (Windows Settings->Security Settings->Restricted Groups) new group -> select -> LocalAdmins
- This group is member of (select -> administrators)
This policy is not deployed to domain controlers (different OU) but TestAdmin can logon and administer domain.
How to fix this.