The security team in my company has full admin rights on servers so they can reset the local administrator password when necessary and create local user accounts. I want to restrict it so they can fully manage all local user accounts on servers, including the built in administrator account, but not have full administrator rights. None of my research or efforts have proved fruitful. Any suggestions?

If they can manage the local administrator account then they have full admin rights and privileges, there's no way around that.Paul Adare CTO IdentIT Inc. ILM MVP