Byron
Thu Feb 02 02:12:32 CST 2006
In addition to Steven's approach of auditing, you could also go about it
like this:
1. Restrict the use of Administrator and Domain Admin accounts to a very,
very, very small number of highly trusted people.
2. Create one account and delegate to it the permissions required to create
a user
3. Create a web application that creates users
4. Configure that web application to run in the security context of the account
created in #2
5. Restrict access to the web application to a particular security group,
make the users authorized to create users part of that group
6. Have the application send email and/or create log files when accounts
are created
7. Have the application perform whatever other business-rule checking or
additional configuration steps required.
It's quite a bit of work to set up at first, but once up and running, it's
pretty slick.
Byron Hynes
Windows Server
Microsoft Corporation
http://spaces.msn.com/members/byronphynes
> Hi ,
> when someones adds a new windows account, i want to receive a
> notification
> . How i can do that ?
> Thanks
>