To help prevent any unauthorized change from a Mixed Mode to a Native Mode domain, you can restrict the Change Mode button to members of the Enterprise Admins group:
01. Open the Active Directory Users and Computers snap-in.
02. Right-click the domain name and press Properties.
03. Select the Security tab.
04. Press the Advanced button.
05. Select Domain Admins (<DomainName>\Domain Admins) Special and press the View/Edit button.
06. Select the Properties tab.
07. Make sure that the Apply onto drop-down list is set to This object only.
08. Clear the Allow check box for the Write nTMixedDomain permission and press OK.
09. Select Administrators (<DomainName>\Administrators) Special and press the View/Edit button.
10. Select the Properties tab.
11. Make sure that the Apply onto drop-down list is set to This object only.
12. Clear the Allow check box for the Write nTMixedDomain permission and press OK.
13. Press the Apply button.
14. Press OK and OK.
To grant this permission back to Domain Admins:
01. Open the Active Directory Users and Computers snap-in.02. Right-click the domain name and press Properties.
03. Select the Security tab.
04. Press the Advanced button.
05. Select Domain Admins (<DomainName>\Domain Admins) Special and press the View/Edit button.
06. Select the Object tab.
07. Make sure that the Apply onto drop-down list is set to This object only.
08. Check the Full Control Allow box and press OK.
09. Select Administrators (<DomainName>\Administrators) Special and press the View/Edit button.
10. Select the Object tab.
11. Make sure that the Apply onto drop-down list is set to This object only.
12. Check the Full Control Allow box and press OK.
13. Press the Apply button.
14. Press OK and OK.
