You'd need to make deny entries for those individuals in the DA group that you don't want making changes. However, they could simply remove the Deny entries. You can't. Even if you set up additional ...

My apologies if I bungle any terminology or phrasing, I'm a bit new to this. Would you recommend any tools to temporarily grant a user domain admin privileges? For example, let's say you want to ...

Creating a group in the domain containing the domain accounts that are allowed to administer machines, and adding that domain group name to the local administrators group on each machine, let you ...