From: bchambers@cable0ne.n3t   
      
   Lars Uffmann wrote:   
   > Title says it all: Just by joining the machine to a domain, how much   
   > control do domain admins get over the system?   
   >   
      
   	Total control.   
      
   > e.g.:   
   > - can they control update rollouts to the domain clients?   
   > - can they remote access administrative shares (\\machine\c$,   
   > \\machine\d$ etc)?   
   > - can they manipulate the registry settings?   
   > - can they use remote Desktop services?   
   >   
      
   	Yes, to all.   
   	   
      
   > If the answer is "yes" to my first example, I guess that would mean full   
   > control over the computer...   
   >   
      
      
   	Exactly.  After all, the computer isn't your property, it's your   
   employer's.   
      
      
   > Next question would be: Is it possible to lock out domain admins from   
   > your computer (completely) if you don't trust them?   
      
      
   	No, and, in many companies, attempting violate company policies in this   
   manner is a shortcut to the unemployment line, since one would be   
   tampering with, and potentially sabotaging, company property, as well as   
   ignoring one's "terms of employment."   
      
   > Given of course that   
   > you have local administrator rights and join the machine to the active   
   > directory yourself...   
   >   
      
   	Only domain administrators, or specially designated accounts, can join   
   a computer to a domain.   
      
      
   > And how would you do that if it is possible?   
   >   
      
      
   	Anything is possible, but, if you have to ask, you clearly lack the   
   requisite skills.   
      
      
   --   
      
   Bruce Chambers   
      
   Help us help you:   
   http://www.catb.org/~esr/faqs/smart-questions.html   
      
   http://support.microsoft.com/default.aspx/kb/555375   
      
   They that can give up essential liberty to obtain a little temporary   
   safety deserve neither liberty nor safety. ~Benjamin Franklin   
      
   Many people would rather die than think; in fact, most do. ~Bertrand Russell   
      
   The philosopher has never killed any priests, whereas the priest has   
   killed a great many philosophers.   
   ~ Denis Diderot   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)