2000 ADS Account question (W2K)

[andyhalsall]

Hi

I have a Windows 2000 Server running ADS, I have a user that has and has to have admin rights that I delegate to another user to do basic admin work.

This account as it is part of the domain admin group can change the administrator account. This account has to be an administrator but I want to tiy it down to prevent it being able to change the administrator account password. Can anyone help with this???

Any ideas would be apreciated?

[kastetx]

I dont know what exactly youre asking, but:
the is a change password right, and change password hash or whatever you want to call it in a regular group policy. Just deny that right or policy to that particular user.

[andyhalsall]

Where can I deny the user to change the password for the administrator account I didnt know you could do this and for specific accounts??????