Re: Domain Users to have Local Admin rights

What Brooster posted only works when you are OK with having
all machines that are with scope of the GPO carrying the Restricted
Group definition for Administrators have identical membership for
their local Administrators group.
This is quite often not possible.
If all of the machines are current versions of Windows at latest
service pack, then one can do an inverted form of using Restricted
Group. Say you have a custom domain group HelpDesk. If in a
GPO linked to OU containing (somewhere) within (subOU structure)
the machines on which HelpDesk should be in the local Administrators
group you define a Restricted Group definition, not for Administrators
but for HelpDesk. Now, the trick is that you do not set anything in
the Members list of the Restricted Group definition but you do set
Administrators in the Member Of list. When that GPO applies to
the subjected machines HelpDesk will be added to Administrators
and what was already in Administrators will remain.
However, keep in mind that GPO application is driven by change,
that is, GPO is reapplied when it is seen the GPO has changed.
The result from this is that if a local admin alters the membership
it will stay altered until the GPO is reapplied. There is a policy that
causes GPOs to be applied always, even if no change has happened,
but keep in mind this will cause work and network traffic approx
every 90 minutes per machine.

Take a look at
http://support.microsoft.com/kb/810076
but do not be put off by the article title (which is slightly inaccurate)

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1255jubreasa613@xxxxxxxxxxxxxxxxxxxxx
well here is the problem. That I am not sure about using Broosters
solution.

We have various admin accounts other then administrator
on some of the client machines, and we do not want to
have it remove those, because some are laptops and they
use those accounts when they login at home. Is there anyway to be able to
keep their current admin accounts also?


"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:ec6NvGwaGHA.4772@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

Brooster posted a solution to your question.

What I would like to add is a warning against using domain administrator
accounts to logon to user computers.
So simply put -- don't use accounts that have domain administrator
permissions for logging on to client computers. Use these accounts only
for working on domain controllers.
For logging on to client computers create new accounts (e.g. admin-mike,
admin-greg, etc) and add them to a group called e.g. Help Desk. Now add
this group to Local Administrator group by using solution proposed by
Brooster.

--
Mike
Microsoft MVP - Windows Security

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1254qjd2uso6j84@xxxxxxxxxxxxxxxxxxxxx
Ok we recently installed Microsoft Server 2003 Enterprise Edition on our
PC. The whole domain is working and everyone has thier own login that
works. The only thing is, those users do not have local admin privledges
on the PCs they logon to.

We wish to have a handful of users, HelpDesk, that when they login to
any machine, they automatically get admin privledges on the workstation.

We tried playing with Group Policy Editor but nopthing at all will work.







.

Relevant Pages

  • Re: Disabling Interactive Logon Against Security Group
    ... Essentially this is to secure half a dozen guest accounts on domain of ... question "disable interactive logon privilages against specific OU/User ... Where I follow least privilege this is a total non-issue, as the machines ... If you set this in a GPO then the list that is to be denied that you ...
    (microsoft.public.security)
  • Re: Basic Sec Template Design
    ... defined in a GPO linked to the domain object to impact domain accounts ... allowed to impact machines then these impact the machine local ... Have you also reviewed the security guides? ...
    (microsoft.public.windows.server.security)
  • Re: Cannot Add Domain Accounts to Local Admin Group
    ... domain user accounts into the Local Administrators group ... is only the default GPO implemented. ... the 'Domain Admins' group is a member of the ... >'Administrators' group on each client system. ...
    (microsoft.public.win2000.active_directory)
  • Re: Rights to local machine
    ... Inside of GPOs there is Restricted Groups node. ... If in a GPO linked to an OU containing the machines ... should be in the Administrators group on impacted ...
    (microsoft.public.windows.group_policy)
  • Re: Disable Web Access to Specific Workstations
    ... ill-advised to assign permissions to individual User or Computer accounts ... application of Group Policy will be unnecessarily ... you are correct in that the GPO setting I mentioned will not meet ... manufacturing MACHINES in that OU. ...
    (microsoft.public.windowsxp.network_web)