How can I make it so that the IT department group can reset the password for users outside of the IT department?

Question

Active Directory

There is an IT group that serve users and can reset user passwords and access administrative shares as $users.
The problem is that these IT team members can reset each other's passwords and gain $$ access to the drives. How to limit this situation?

Answer 1

This can be limited by the rights to reset passwords.
1. Transfer the IT group to a separate OU.
2. Remove\prohibit the rights to reset passwords.
3. Add the rights to reset passwords for the SELF principal
to the OU And prohibit changing the rights to the OU :-)

Answer 2

No way. Audit logs are the only deterrent.