I am implementing firewalls in my environment in a tiered fashion. One of the tiers is how to poke holes into atypical server configurations without giving local administrators rights to do this. I want to enable a domain level group to set local firewall exceptions. Is this possible? For example, If i need port port 5000 open, i want a domain security group named "windowsadmins" to be able to add a local firewall exception, but not any of the current local administrators.