- key: "/client-admins"
  displayname: "Client administrators"
  explaintext: |
    Define users and groups from AD allowed to administer client machines.
    It must be of the form user@domain or %group@domain. One per line.
  elementtype: "multiText"
  note: |
   -
    * Enabled: This allows defining Active Directory groups and users with administrative privileges in the box entry.
    * Disabled: This disallows any Active Directory group or user to become an administrator of the client even if it is defined in a parent GPO of the hierarchy tree.
  type: "privilege"

- key: "/allow-local-admins"
  displayname: "Allow local administrators"
  explaintext: |
    This allows or prevents client machine to have local users gaining administrators privilege on the machine.
  note: |
   -
    * Enabled: This leaves the default rules for the “sudo” and “admin” rule intact.
    * Disabled: This denies root privileges to the predefined administrator groups (sudo and admin).
  type: "privilege"

