Administrator account lock down, please help

[Barry]

I need to have an administrator account that can not
erase or change existing accounts. Like the Power users
account is setup. There must be sometype of system
registry entry or something? Please help... Thanks

[Roger Abell {MVP}]

Your closest approach will come from taking a=20
user or power user account and then adding to it=20
the extra privs that are needed for whatever it is=20
you want the account enabled.
You will not be successful in the direction you=20
indicate, restricting down an admin account.

--=20
Roger Abell
MS MVP (Security, Windows), MCDBA, MCSE both
Associate Expert - Windows XP ExpertZone
http://www.microsoft.com/windowsxp/expertzone

"Barry" > wrote in message =
...
> I need to have an administrator account that can not=20
> erase or change existing accounts. Like the Power users=20
> account is setup. There must be sometype of system=20
> registry entry or something? Please help... Thanks

[Barry]

OK, how to allow power users to load or unloard device
drivers? Thanks Barry
>-----Original Message-----
>Your closest approach will come from taking a
>user or power user account and then adding to it
>the extra privs that are needed for whatever it is
>you want the account enabled.
>You will not be successful in the direction you
>indicate, restricting down an admin account.
>
>--
>Roger Abell
>MS MVP (Security, Windows), MCDBA, MCSE both
>Associate Expert - Windows XP ExpertZone
>http://www.microsoft.com/windowsxp/expertzone
>
>"Barry" > wrote in message
...
>> I need to have an administrator account that can not
>> erase or change existing accounts. Like the Power
users
>> account is setup. There must be sometype of system
>> registry entry or something? Please help... Thanks
>.
>

[Peter Clark]

local security settings in administrator tools in control panel

security setup\local policies\user right assignment\
load and unload device drivers -> add the group or user(s)

the only way you could restrict the administrator is to
deploy the software restriction policies, however this can
be updated in safe mode by administrators.


>-----Original Message-----
>OK, how to allow power users to load or unloard device
>drivers? Thanks Barry
>>-----Original Message-----
>>Your closest approach will come from taking a
>>user or power user account and then adding to it
>>the extra privs that are needed for whatever it is
>>you want the account enabled.
>>You will not be successful in the direction you
>>indicate, restricting down an admin account.
>>
>>--
>>Roger Abell
>>MS MVP (Security, Windows), MCDBA, MCSE both
>>Associate Expert - Windows XP ExpertZone
>>http://www.microsoft.com/windowsxp/expertzone
>>
>>"Barry" > wrote in message
...
>>> I need to have an administrator account that can not
>>> erase or change existing accounts. Like the Power
>users
>>> account is setup. There must be sometype of system
>>> registry entry or something? Please help... Thanks
>>.
>>
>.
>