Hi,

we are trying to delegate SEPM administration to helpdesk. Helpdesk accounts are set as Limited Admins and can see only one group in SEPM. Admins accounts use AD authentication for easy setup.

Recently I found out that limited administrator can create sub group and to his group in SEPM and import any Organization unit from AD. If he has permission to remotely reboot machine he could do it on every machine in AD domain!!

Is there a way how to disable this behaviour while still keeping LDAP servers configuration?

Any ideas?

What permissions are needed on AD account used from AD authentication? Is it used for importing AD Containers?

Thanks

David