Re: Domain Users to have Local Admin rights

ok, I went to group policy. Refreshed group policy on the other machines. I
created a startup script to do what you just said, but it seems as if
nothing happened. I even restasrted the workstations, still nothing seems to
be happening.
"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:%23ZJ6eu7aGHA.508@xxxxxxxxxxxxxxxxxxxxxxx
I man, you have to "deploy" this as startup script using Group Policy.

--
Mike
Microsoft MVP - Windows Security

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:12578jqj9mkg6fb@xxxxxxxxxxxxxxxxxxxxx
But then we are startup scripts? Or do you mean add to each and every
machine, that kinda startup script?
"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:eZumSO2aGHA.1536@xxxxxxxxxxxxxxxxxxxxxxx
In this case you can still use Group Policy but in this case you can use
_startup_ script (_not_ logon script) to add e.g. Help Desk group to
local Administrator group on all the computers. The script that you can
use looks like this

net localgroup Administrators domain\HelpDesk /add

domain in above command is netbios name of your domain.

This way HelpDesk will only be added -- without removing any other
groups.

--
Mike
Microsoft MVP - Windows Security

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1255jubreasa613@xxxxxxxxxxxxxxxxxxxxx
well here is the problem. That I am not sure about using Broosters
solution.

We have various admin accounts other then administrator
on some of the client machines, and we do not want to
have it remove those, because some are laptops and they
use those accounts when they login at home. Is there anyway to be able
to keep their current admin accounts also?


"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:ec6NvGwaGHA.4772@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

Brooster posted a solution to your question.

What I would like to add is a warning against using domain
administrator accounts to logon to user computers.
So simply put -- don't use accounts that have domain administrator
permissions for logging on to client computers. Use these accounts
only for working on domain controllers.
For logging on to client computers create new accounts (e.g.
admin-mike, admin-greg, etc) and add them to a group called e.g. Help
Desk. Now add this group to Local Administrator group by using
solution proposed by Brooster.

--
Mike
Microsoft MVP - Windows Security

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1254qjd2uso6j84@xxxxxxxxxxxxxxxxxxxxx
Ok we recently installed Microsoft Server 2003 Enterprise Edition on
our PC. The whole domain is working and everyone has thier own login
that works. The only thing is, those users do not have local admin
privledges on the PCs they logon to.

We wish to have a handful of users, HelpDesk, that when they login to
any machine, they automatically get admin privledges on the
workstation.

We tried playing with Group Policy Editor but nopthing at all will
work.













.

Relevant Pages

  • Re: better way to limit users/group to logon to specific workstati
    ... accounts can log on to them", we want: "here's a set of accounts and they can only logon to these machines". ... Write a script that would overwrite the users' "Log on locally" attribute in Active Directory and replace it with the valueof the machines you want. ... Create a startup script in which you get the user's name, enumerate the user's group and then determine, whether he may log on to that machine. ... Microsoft MVP - Windows Server - Group Policy. ...
    (microsoft.public.windows.group_policy)
  • Demoting users from admin to limited
    ... I have several XP Pro machines deployed at my small company's site ... My boss wants me to revoke admin rights on all the ... Administrator, XP will not allow me to demote all accounts to limited. ...
    (microsoft.public.windowsxp.basics)
  • Re: Invisible Admin account
    ... if they are admin they can undo anything you ... or specific accounts log in with smart ... Short of hacking your machines up with your own rootkit-like ... Adminstrator account that another user with administrator access could not ...
    (microsoft.public.win2000.security)
  • Re: Local Accounts
    ... All 3 users had accounts on all 3 computers. ... Well maybe true but when the client machines were not in a domain we had sofware installed that we did not want to reinstall when on the domain. ... The local admin account can be useful for some system changes, ...
    (microsoft.public.windows.server.sbs)
  • Re: ADMINISTRATOR vs Administrator User
    ... when run on an administrator account. ... As to getting past the limitations imposed by WindowsXP ... There are very few - very very few - modern applications that require ... user accounts. ...
    (microsoft.public.windowsxp.general)