Re: Full access without Administrative rights

From: Torgeir Bakken \(MVP\) (Torgeir.Bakken-spam_at_hydro.com)
Date: 09/27/04 

Date: Mon, 27 Sep 2004 19:58:20 +0200

Hugo wrote:

> Hi !
>
> This is not a solution.... I want ALL users be able to do everything on ALL
> workstation..... without having to give them Administrator membership !!!
> Because I don't want them to be able to use administrative share and some
> other functionnality !!!

We solve this by adding "NT Authority\Interactive" to the local
Administrators group to let all domain users automatically be local
admins when they log on to a computer interactively.

This is more secure than adding "Authenticated Domain users ",
"Domain Users" or "NT AUTHORITY\Authenticated Users" because you
avoid the issue with cross network admin rights (remote access)
that these groups introduces. 

-- 
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: Full access without Administrative rights
    ... Administrators group to let all domain users automatically be local ... avoid the issue with cross network admin rights ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windows.group_policy)
  • Re: Script to enumerating list of Local Admingroup member of all d
    ... How to Configure a Global Group to Be a Member of the Administrators Group on ... This is more secure than adding "Authenticated Domain users", ... avoid the issue with cross network admin rights ... torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway ...
    (microsoft.public.windows.server.scripting)
  • Re: Local Admins
    ... We add NT Authority\Interactive in the local Administrators group to let all ... domain users automatically be local admins when they log on to a computer ... Microsoft MVP Scripting and WMI, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Local Admins
    ... We add NT Authority\Interactive in the local Administrators group to let all ... domain users automatically be local admins when they log on to a computer ... Microsoft MVP Scripting and WMI, ...
    (microsoft.public.security)
  • Re: Heddin shares restrections
    ... Restricted Groups enforced with Group Policy is maybe an option: ... How to Configure a Global Group to Be a Member of the Administrators Group on ... This is more secure than adding "Authenticated Domain users", ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.win2000.security)