[Samba] best practice for domain admins

[Rowland penny]

On 07/08/2019 10:25, Stefan G. Weichinger via samba wrote:
> I expect the next "you should know" here.
>
> How do you handle administrative accounts in your samba/windows domains?
>
> I have to provide some accounts for the so-called admin users at the
> customer ... in some cases they learned the main admin pwd (yes, bad)
> and used it for installing this and that.
>
> Add their own users to group "domain admins"?
>
> I'd like to take away the main admin pwd from them. I have to.
>
Rule one, never tell anyone the Administrator password

Try reading about delegation on Active Directory.

Rowland