>Hi Bruce
>
>I'm far away of beeing an NT-guru (yet, but I'm working on it :-) ) but I have here a group called "Domain Admin" that can access user and user rights and can also be restricted from further activities on the server. Isn't that what you're looking for?
>

Any group can have the necessary administrative privileges granted to it to perform user and group administration; typically, the Domain Admin group, and Domain Account Operators, have the necessary privileges to create and assign users and groups, but typically Account Operators cannot grant new access privileges to the accounts they administer - those rights reside with the domain administrators. Domain administrators do not automatically have local administrative rights - they may not be able to start and stop services on the local machine, create local users, and alter local system configuration items; I typically allow my domain admins local administrative rights to simplify the process of local administration, such as installing SPs, adjusting system times, and installing updated driversthat apply to the workstation's configuration, as opposed to the domain administration issues of access control, trusts and the like. The responsibility and assignment of duties changes when a Win2K network environment using Active Directory functions differently; specific functions can be delegated to separate groups with explicitly defined subsets of the overall Active Directory scope is possible and supports finer granularity of implementation than permitted with the NT domain structure. A domain can use both Win2K and WinNT servers - it's been simplest for me upgrading all the domain controllers to Win2K and using Active Directory, but I've only done this a few times, with most of the upgrade performed automatically and a small number of systems to deal with, and I'd already spent a day converting my own LAN at home to Win2K, and I'd already made most of the obvious dumb mistakes once and had time to recover from the concussion and bumps on my head.

>Because I made a standard installation of NT server this must be a standard group, so you should have it also. Can't say much more about it here from home, but I'll have a look on it tommorrow in the office.
>
>HTH
>Markus