Hi Bruce

I'm far away of beeing an NT-guru (yet, but I'm working on it :-) ) but I have here a group called "Domain Admin" that can access user and user rights and can also be restricted from further activities on the server. Isn't that what you're looking for?

Because I made a standard installation of NT server this must be a standard group, so you should have it also. Can't say much more about it here from home, but I'll have a look on it tommorrow in the office.

HTH
Markus