Controlled GPOs Still Editable by Others

[bbartel]

I've just installed AGPM 4.0 and am thoroughly confused. I have downloaded Jeremy's chapter on AGPM and am following along with it as I'm installing/configuring. On page 24, it says that if I log onto another management station and try to edit a GPO I've put under control of AGPM, I will not be able to because it has changed the owner to SYSTEM. Well, it did change the owner, but not to SYSTEM, to the service account I selected during install. And I am logged onto another management station with my domain admin account that I created the GPO with and I can still edit it. Any idea what I may be missing here?

Thanks!

Brian

[scottzaiss]

I believe that Domain Admins will still have rights to edit anything. You could probably take some rights away, but I am always nervous to take rights from Domain Admins.