Re: Help needed setting up roaming administrator

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 08/27/04 

Date: Fri, 27 Aug 2004 15:13:56 GMT

As Paul mentions Restricted Groups is one option but it probably will remove existing
members of the local administrators group from computers on the container where it is
implemented. Another option is a "startup" script implemented via Group Policy to
computers within the scope of influence of the policy such as the Organizational Unit
level. You can use the net localgroup command. Use net help localgroup for more
information at the command prompt. For instance to add domain user Bubba to the Local
Administrators group use [ net localgroup administrators mydomain\Bubba /add ]. The
command line tool cusrmgr can also do the same with a batchfile. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;322241 --- Group Policy
scripts and how to configure

"Paul Adare - MVP - Microsoft Virtual PC" <padare@newsguy.com> wrote in message
news:MPG.1b98bc09e8ded3d0989a36@msnews.microsoft.com...
> In article <dq5ti0pgulb811ce1c12h2vgotj1967bdv@4ax.com>, in the
> microsoft.public.win2000.security news group, Steve Hull
> <msnnews.REMOVE_TO_REPLY@steve-hull.com> says...
>
>> This leads to another question. I really don't want to walk around to
>> each workstation and manually add DOMAIN\JOE to the local admins
>> group. Is there any way to automate this (e.g., GPO, Script, etc.) ??
>>
>
> You can do this with the Restricted Groups option in Group Policy. You
> really should read up on the feature (in help, and on the Microsoft web
> site) before doing this however. You need to make sure that you set the
> policy at the right place (for example, if you do this at the domain
> level, you're going to wind up adding the account to the Administrators
> group on your Domain Controllers as well as the workstations, which you
> might not want to do). You also want to make sure that you keep the
> default users and groups in the local Administrators group.
>
> --
> Paul Adare
> This posting is provided "AS IS" with no warranties, and confers no
> rights.

Relevant Pages

  • Re: Giving admin rights to a subset of computers
    ... computers exist in the 'Computers' folder under the domain. ... created a restricted group 'ATL-RG'. ... > I would create a new Group Policy in that OU or modify one that you already ... > that global group to be "this group is a member of" administrators group. ...
    (microsoft.public.win2000.security)
  • Re: Group Policy
    ... administrators group of all computers in the domain. ... restricted groups, however this GP setting will remove all the users ... to add a domain group to the local administrators group ...
    (microsoft.public.windows.server.active_directory)
  • Re: administrative privileage Q.
    ... You could use Group Policy Restricted Groups at the Organizational Unit ... place the computers in the OU where you want him to be a local admin. ... configure Restricted Groups and use "member of" for administrators group. ...
    (microsoft.public.windows.server.security)
  • Re: Default Security Groups
    ... I then follow your steps to apply restricted groups, ... to the computers administrator group i.e not altering any groups/users ... Domain Admins group will be added to local administrators group by ... Click the Group Policy tab, click NEW, and then name the policy. ...
    (microsoft.public.windows.server.migration)
  • Re: Default Security Groups
    ... I then follow your steps to apply restricted groups, ... computers within a domain. ... Domain Admins group will be added to local administrators group by ... Click the Group Policy tab, click NEW, and then name the policy. ...
    (microsoft.public.windows.server.migration)
Loading