Prevent DSA.MSC from deleting user accounts

hello,

i trying implement ou's "protect accidental deletion" on user accounts. problem here still member of domain admins, have right "take ownership". although remove permissions user account, remove inheritance , set permissions , exactly:

everyone = deny = delete, delete subtree
= allow = read
owner = single user account, not me, not domain admins, not administrators

the dsa console takes ownership of object, changes permissions , deletes object (probably). auditing info operation just:

ds access: failure - delete
account management: success - user deleted

so know:
a) how prevent dsa deleting user accounts when domain admins member.
b) ____ happens not see auditing info on object having permissions/owner changed after first ds access delete fails.

thank much.

 

ondrej.

 

everything solved. sory troubling. ou had delete user objects permission not audited , used delete object instead of permissions on user object itself.

o.

Windows Server  >  Security