Dynamic Groups - Deny changes

Question

Chaps. 
 We have Admins who have access to the MMC console and as such have the ability to change Dynamic group membership. Is there away to stop say AdminGroup1234 from being able to edit specific Dynamic groups? 
 Thanks in advance

JohnnyQuest · Answer

Stu.Pollock suggestions are spot on (and I agree with him regarding deny's in general). I would take the groups that you want to restrict and place them all in a specific OU. Use that OU as part of the start conditions for the workflow that Stu suggested that intercepts the change request. So the middle part of your start condition would consist of: 1) Some security group containing the admins who's activities you want to restrict 
 2) The "restricted dynamic groups" OU 
 Thus changes made by the restricted admins on the groups in that OU would be "trapped". The problem of course is that you then need to start putting in more controls over the membership of that restricted admins group and the movement of dynamic groups out of that OU. Do you own Quest's Change Auditor product? If not, you should have a look at it because even though you might not be able to restrict who is an AR admin or an admin in general, you could put into place some reporting and alerting on their activities.

Endpoint Privilege Management

Dynamic Groups - Deny changes

Top Replies