>Hi Bruce
>
>I'm far away of beeing an NT-guru (yet, but I'm working on it :-) ) but I have here a group called "Domain Admin" that can access user and user rights and can also be restricted from further activities on the server. Isn't that what you're looking for?

It's definitely standard. But I think Domain Admin is on our restricted "secure" list of access levels, because it's fairly close to straight Admin.

I surely wish the NT Help had better definitions of these levels, I can only find very brief tidbits on them, even in MSDN help.