You suggest that all admin accounts have complete unrestricted access to everything. This is untrue. It's all just default Windows settings. You may go the extra step and strip and suppress all admin accounts of their power, however you may not give that power to standard accounts.
This is incorrect. The whole purpose of the existence of the administrators group is to make them "all-powerful" in that they can do anything to the system. As there is no nothing with more privileges than them, save the kernel itself and drivers.
Restrictions can be placed upon admins, but an admin will always have the power to undo those changes, which makes the whole thing more annoying, but ultimately possible.
Could you show what method are you proposing for this?
Okay, it probably was a stretch saying that all administrator accounts do not have complete unrestricted access to everything. I've emphasised my point a little far. Administrators are 'all-powerful' in that they do have the ability to make any change to the system they wish, you are right. And I would like to highlight that point you make about restrictions on admins,
Restrictions can be placed upon admins, but an admin will always have the power to undo those changes
This is exactly the point I would have liked to convey instead. Privileges can be taken away and restrictions can be placed on Administrators, but they will always have the power to regain those privileges or un-restrict themselves (despite any amount of restrictions they have, or privileges they don't), though it can become difficult to do so, to the point where 'all-powerful' becomes questionable.
For instance, no administrator can just jump into System32 and massacre every file immediately. They'd have to first grant themselves the correct permissions. In order to do that they must first take ownership of all the files--which any administrator can do at any time--no matter how badly denied they are to those files. The fact that any administrator can take ownership at will is due to a Windows setting allowing them to do so, by default. Using Group Policy, this privilege can be taken away from them, making it harder to touch those files in System32. Then Group Policy can then be restricted by setting one registry value in Regedit, then Regedit can be blocked by using the Command Prompt to make registry changes instead. And one could even block the Command Prompt by using the Command Prompt itself, after blocking PowerShell of course. (You'd still be able to run commands, but) here would sort of be the 'furthest possible point' away from ever being able to, well, delete all those System32 files. Anyone at this point who could use an administrator account to delete every last file in System32 really deserves a cookie. If you could cheat a bit by booting into another OS to delete that command that edits registry keys (namely Reg.exe), then you'd truly have administrator accounts without their 'all-powerful'-ness, being restricted to at least
something, that something being able to delete System32.
It's a real stretch but at this point, using an administrator account on its own could not undo those steps.
Pyprohly - which settings am I wanting to lock? You mean other than the DNS address permissions? None. Those are the ones I want to lock.
Alright then. I'm going to assume you are referring to all the settings shown in the image of step 7 in
this tutorial.
I've attached two batch files to this post. One of them will lock the DNS settings, other will unlock them. Both batch files require the SubInACL command which you can get from
here.
To use the batch files I've attached:
1. download and install the SubInACL.msi package at that link above,
2. take just the SubInACL.exe command from the location you've installed it to,
3. uninstall the SubInACL package,
4. download one of the batch files in this post,
5. place that batch file in the same folder as the SubInACL.exe command,
6. run the batch file, then delete both the batch file and the SubInACL.exe command.
Yes, to promote your self-regulation, M33, these steps are purposely lengthy. Oh, and the commands that the batch files execute are mostly encoded, so you'll not know what registry keys are being edited in order to lock the DNS settings.
When ever you need to unlock the DNS settings, all you have to do is locate this thread and follow those steps.
Edit: faulty scripts removed.
.
