I have 3 user accounts. Two admin user accounts and one standard user. I don't want any admin account to be able to change the password of the other admin account. In short I want all the 2 admin accounts to be independent of each other and any of them can't change passwords of other. Is there any rule in the group policy that I can set to enforce this?
Now in the control panel if I login with the admin account and see the user accounts, it shows this option "Manage another account" through which I can change the other admin account password. I should not be able to do that. Please help.
Best Answer
It has already been said in another answer, but to clarify things, I've decided to still write an answer.
Yes, A user that is added to the local administrators group, gets full control on that computer, and they can do anything on that computer, including changing other local users.
However, notice how I write local users.
While local admins can do anything to a local computer, they cannot make changes to domain accounts, as that requires access to the domain controller.
If you want to prevent local admins from changing other users password, you will need to use a domain controller, add the computer to the domain and migrate the user accounts to the domain controller.
After that, local admins can still do a whole lot on that pc, but they can no longer change the password of other admins, if those admins are domain users.
That said, with admin access, you can create local users, and login with that.
Also good to note, while many tasks seem to require admin access, this is not always necessary. Admin access is requested when a task fails due to insufficient rights. For example, installing a program in C:\Program Files, requires admin access because by default, normal users may not write to this folder. If you make this folder writable for normal users, then they no longer need admin access for installs that just place the program in that location. Similarly, the local machine registry hive has similar restrictions that can also be opened similarly.
I would advise against opening these with write permissions for everyone, but you can add these specific users to those locations with write permissions and they may not need an admin account in the first place.