I would like to stop domain admins from being able to modify the membership
of the domain admins group.
I have modified the following security on thr domain admins group
Removed Write permission

Simplified Scenario of our configuration:
We have a W2K3 DC which hosts a share (share permissions:
Authenticated Users = Read Access;
NTFS permission :Administrators = Full Control)

Is there any way to print or list to a file, all the user, group, and file
permissions on a Windows based server? This information is needed for a
Sarbanes Oxley audit, so I imagine other system administrators are having
this same problem.

I recently experienced an invasion on my server and am having trouble
identifying the cause and means of removing the malicious software. I'll
explain my process of how I determined this to give you an idea of what's
going on.

is it normal to have a lot of event viewer messages in the security section
like this following one:
----
Tipo evento:    Operazioni riuscite

I have installed SP1, but have not run the Security Configuration Wizard.
Is there any difference in its security "level" or strength without running
the Wizard? Does that all take place after I run it?
I want to know if I can deploy SP1 and NOT break clients functionality, then

Is there a script to check if an account is in the administrators group and
to remove the account from the adminstrator group?
This is for a windows  2003 server without AD. Thank You.

I have just installed a fresh w2k3 standard server and just added the WINS
role to it. However when I open the WINS console and try to click on the WINS
server listed to configure it, I get access denied error. I am logged in as
the domain admin. How can I configure it and why is ...