What we’re doing here is preventing an admin from making ‘improvements’ to a production Task Sequence without testing it.

Optional: Remove admins’ ability to alter security scopes (except you, naturally).Remove ‘ Default’ Security Scope from Task Sequences you are trying to protect.Remove ‘ ALL’ Security Scope from all SCCM admin accounts (except your own).Create and attach a new, more restrictive Security Scope to the TS.One of the strategies you can use to keep track of changes to your Task Sequences is to force your admins to make a copy of the Task Sequence every time they want to alter it.įour extra steps you can perform to enforce this behavior: Most importantly it prevents your helpdesk guy who somehow has admin access to SCCM from deleting all the things.

This approach is a bit ham-fisted, but it requires the least privileges to be given to the ‘Operator’ and the least amount of training–which in turns allows more time for writing blogs. My personal use case scenario for for this is attaching security scopes to Task Sequences for the purpose of version control. Revision Control in SCCM is not easy, but it does work extremely well if you are willing to put some effort into it.

How to disable skype for business sccm