Negative right to disable ability for domainadmin to create domainadmin accounts?

[ThomS]

I would like to revoke the ability for a domainadmin to create (or upgrade an account to be) a domainadministrator.

Is there an attribute right in Zimbra that I can use to achieve this? I have searched the zimbra site, the forums and the Zimbra Admin manual but haven't found an answer to this.

We are currently using Zimbra version 6.0.8.

Thanks

[Saturdays]

Originally Posted by ThomS

I would like to revoke the ability for a domainadmin to create (or upgrade an account to be) a domainadministrator.

Is there an attribute right in Zimbra that I can use to achieve this? I have searched the zimbra site, the forums and the Zimbra Admin manual but haven't found an answer to this.

We are currently using Zimbra version 6.0.8.

Thanks

check if revoking the modifyaccount right for the domain admin will fix the issue.

[fyd]

Originally Posted by ThomS

domainadmin to create (or upgrade an account to be) a domainadministrator.

Is that a typo? you referring the latter to globaladmin I guess.

[ThomS]

Originally Posted by fyd

Is that a typo? you referring the latter to globaladmin I guess.

Not a typo, but you are right that it is a weird sentence. What I meant is that I also want to disable the possibility to upgrade a normal user account (non-admin ) to domainadmin.

@Saturdays: thanks for the suggestion. I will check whether this does the trick and let you know.

Thanks so far

[fyd]

Originally Posted by ThomS

Not a typo, but you are right that it is a weird sentence. What I meant is that I also want to disable the possibility to upgrade a normal user account (non-admin ) to domainadmin.
Thanks so far

Its better now .. I just played around with domain admin rights, it is a jungle out there. Besides taking away the right to change an account to domain admin status, adding modifyAccount as a negative attribute will take away some other privileges from the domain admin as well like modify account contact details.

But that is the closest I could get. Another one was giving negative attribute with 'setDomainAdminAccountAndCalendarResourceAttrs'

I would like to revoke the ability for a domainadmin to create

Under default right, a domain admin won't be able to create a domain admin in the first place, only upgrade the status of a normal account.