Not allow admin users to change password

[Nolf3]

Don't know if I'm overthinking this one, but I have Win2k users not on a domain, which I like to give Admin rights to, but I'd like it if they weren't allowed to change the default Admin accounts password. I want the users to be able to install programs, use windows update whatever, but I want to keep the default Admin account untouched so I know I can get into it if I need to(like when they forget their own passwords). Whats the simplest way to do this? Thanks for any help.

 

[Winchester]

You are wanting to create "Power Users"

 

[VictorLazlo]

Make them "Power Users"

The whole purpose of an administrator account is unfettered access to everything. Once an administrator needs to have his permissions restricted, he isn't an administrator any more.

 

[Nolf3]

I've tried that, but they can't access the windows update or install programs anymore, isn't that correct? I'd like them to still be able to do those things.

 

[Nolf3]

I should rephrase what I want, I shouldn't say 'allow admin users to change password', I just want the users to be able to do everything an admin can except change the default admin account. Is there a easy way to do this. Thanks again.

 

[Nothinman]

Make them admins on the PCs but not on the domain, there's a difference. If they change the admin account on the PCs you should be able to change it back since the domain admins are local admins by default.

And if they keep it up talk to their manager, nothing helps security like a threat from your boss.

 

[Garion]

Yep, that's the ticket. In the local add their domain account to the local admin group on their box . That should take care of it.

- G

 

[gunrunnerjohn]

Download the floppy image from http://home.eunet.no/~pnordahl/ntpasswd/ and create the disk with the easy instructions. If anyone ever changes the admin password, you have the tool in your hand to change it back. 😀

 

[Nolf3]

Thanks for the help guys. Sorry for leaving details out too. The thing is, we're not on a domain. We use alot of standalone laptops. I have ppl who travel and so we assign laptops for short periods, I don't want to restrict them to things cause I don't know when they might need to install something or update. gunrunner, thanks for the link too, I actually have this disk already, but thought there might be a easier workaround to this. Thanks again.