Re: Changing default rights to users of network clients.

From: Steven L Umbach (
Date: 04/23/04

Date: Fri, 23 Apr 2004 14:00:24 -0500

Add their domain administrator account to the local administrators group of
just their computers or a less secure option is to use "restricted groups"
at the OU level for those workstations to add the domain users group [or
other group you create] to the local administrators group for the computers
in just that OU and of course you would not want to have and servers in that
OU. That is the easiest way, but then users can access each other computers
as administrator either via local logon or via the network which is not a
good situation in my opinion. --- Steve;EN-US;Q320065

"" <> wrote in message
> I have reviewed options in group policy and don't see a
> way to do this. I have a network with a mix of Windows
> NT 4.0, Windows 2000 and Windows XP Clients.
> I want to give my network clients administrative rights
> to local workstations, but restrict those rights to
> standard network user rights to other network resources.
> (server files and directories, etc.) Does this require a
> customized policy template?

Relevant Pages

  • Re: Basic User Setup
    ... You could user the computer configuration "restricted groups" to create a global ... restricted groups to enforce the membership of the domain computers in that OU ... want to wipe out current membership of the local administrators group in that OU ...
  • Re: Group Policy
    ... administrators group of all computers in the domain. ... restricted groups, however this GP setting will remove all the users ... to add a domain group to the local administrators group ...
  • Re: Restricted Groups issue
    ... > Keep in mind that Restricted Groups will enforce membership of the ... > Groups on those computers, then I would just manually add those users to ... > the local administrators group on their workstations as it sounds like you ...
  • Re: restricted groups for local admin rights
    ... First off be sure to use Restricted Groups at the Organizational Unit level ... way you can add a global group to the administrators group without affecting ... the current membership of the local administrators group on the computers ... strictly enforce membership of the local administrators group. ...
  • Re: How to disable domain administrator get local administrators group ?
    ... is remove the Domain Admins from the local Administrators group and enable ... auditing on the Administrators membership and on the files in question. ... > In a big network, ... some computers have security data(e.g. ...