RE: Remove domain user from local administrators group

From: Tyson Leslie (Leslie.Tyson_at_colteng.com)
Date: 10/12/04

  • Next message: Sullivan Tim P: "RE: Remove domain user from local administrators group"
    To: chang zhu <cyz2000@yahoo.com>, focus-ms@securityfocus.com
    Date: Tue, 12 Oct 2004 14:03:51 -0600
    
    

    You can make this assignment via group policy. Technically, what you can
    specify is what membership the Administrators group will contain. Note,
    however, that this is a permanent change, removing the policy will not put
    the previous membership back. You can do this with both the Administrators
    group and the Power Users group.

            Tyson.

    -----Original Message-----
    From: chang zhu [mailto:cyz2000@yahoo.com]
    Sent: Tuesday, October 12, 2004 9:17 AM
    To: focus-ms@securityfocus.com
    Subject: Remove domain user from local administrators group

    Hi,all

    I just went to this new company and found out that each domain user is
    assigned to local administrators group.

    We need to remove domain user from local administrators group. Is there any
    MS utility that allows to do this instead of going to each workstation

    to remove and assign them to Power Users group?

    The environment is Win2K and XP.

    Thanks always,

    Chang

    __________________________________________________
    Do You Yahoo!?
    Tired of spam? Yahoo! Mail has the best spam protection around
    http://mail.yahoo.com

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------


  • Next message: Sullivan Tim P: "RE: Remove domain user from local administrators group"

    Relevant Pages

    • Re: Group Policy
      ... I am not a fan of putting any domain user account object in the local ... they are members of the local Administrators group then they can do anything ... I might suggest that you take a spin over to the Group Policy news group. ...
      (microsoft.public.win2000.active_directory)
    • Re: Give Domain Users Local Admin Rights
      ... I know that I could add the indivdual domain user to the ... they do not have local admin ... >> I added DOMAIN USERS to the local administrators group ... >> are logged on to without giving them Local Admin rights ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Add domain user to Local Administrators Group on a workstation
      ... Curt Winter typed: ... workstation in the domain and try and add a domain user to the local ... Administrators Group, it does not show me the domain or allow me to ... via restricted groups & group policy, or even by running a startup ...
      (microsoft.public.windows.server.general)
    • RE: Securing access to network registry
      ... >Thank you for the posting. ... >This is normal because your domain user account is in the ... >registry keys because they are not in the administrators ... >Anyone in the administrators group can have access to the ...
      (microsoft.public.win2000.security)
    • Re: Computer user & domain user
      ... I normally configure two accounts for each workstation. ... Administrators group, it works fine. ... >> software between computer user & domain user in a Windows XP Pro ... > will automatically have permissions for domain users too. ...
      (microsoft.public.windowsxp.network_web)