How to implement restricted admin in Windows?

Question

Windows

It is necessary that the administrator could not perform some actions, for example, clean the system logs. Otherwise, it is necessary that his rights be complete. Is it possible to somehow implement this on Windows 2008?

Answer 1

In general, this is impossible. The domain administrator can regain any rights.
The way out is to revise the security policy, to give administrative powers to the minimum number of people.
Logs are forwarded to dedicated servers, access to which is regulated separately, etc.
Since 2008 there is a dedicated group for "Chukchi log readers" - "Event Log Readers".

Answer 2

It is necessary that the administrator could not perform some actions, for example, clean the system logs. Otherwise, it is necessary that his rights be complete. Is it possible to somehow implement this on Windows 2008?

If the problem is only to save the logs, then the logs can be written to a remote server.