Question

Active Directory Privileges for new admins

Windows Security, Active Directory, Administrative privileges, .

When a new user is added to our Active Directory database, by default, that user has access to all machines. Is there any way to change the domain policy so that, when a user is added, machines are added with this access level by default but, at the same time, deny this option for a second tier admin group? In other words, we have a group with their own admin who is coming into our group, and we would like to make it so this new admin cannot allow their users access to all of our machines.

It sounds like the user is being added to the Domain Administrators group. Simply make sure their account is part of Domain Users and that Domain Users is not in the Local Administrators group on the devices in question. Otherwise, you will need to go through a delegated administrative rights exercise to filter privileges. This is best done using OU and GPO management.