Dealing with untrusted administrators in a Windows domain
I'm trying to block Domain Admins from accessing classified files on PCs that joined the domain. But it looks like impossible tasks, since they could easily bypass any restrictions or auditing set by other admins.
First thought was to grant only needed privileges to all adminis, but that wasn't a trivial task, I'd take it as the last resort.
So, any suggestions?