swaussie

Situation: A Windows 2000 Active Directory tree with multiple sub domains.

Problem: I need to secure a sub domain so that only Domain admins and users within the domain are able to access resources and view info within the domain. Is it possible to lock out Enterprise admins from viewing or accessing any data within the sub domain?

The ultimate goal is to have an NT4 style domain within the forest with its own security boundary.

David_Wallis

fookin ell I wouldnt recommend it, but you could probably do it with ADSI Edit.

David

GaryScoobNCBR

I think you should look at the enterprise admins and ask if they need to have that power, not all admins need enterprise admin rights.

Kieran_Burns

iTrader: (1)

Personally I'd look at a separate Domain, not a child one... this way you can set up trusts for the accounts you wish to, and block those you don't....

You could even set up a one way trust, it simple to implement with Win2K3 - you really don't want to start mucking around with restricting Domain (Enterprise) Admin access... you'll run into all sorts of problems down the line

J1nxy

The Domain in a W2k3 implementations is NOT a secuirty boundry. The Enterprise admin is the God account for the whole Forest. The only way to achieve what you want is to have multiple forests and then setup trusts from the domain in 1 forest to the required domains in the other.

Steve