Re: Domain Users to have Local Admin rights

yes I created the batch file with that. I added it to "Startup" in Default
Group Policy because a new policy doesn't wana work. I added it to domain
ZEROONENETWORKS.

Yes, I logged in as a domain admin. And checked Administrators and nothing
added.
"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:eSbRxe8aGHA.504@xxxxxxxxxxxxxxxxxxxxxxx
Did you create a batch file with

net localgroup Administrators domain\HelpDesk /add

and modified it to represent your environment (domain)? Did you add this
batch file to Group Policy? If yes, what Group Policy did you add it to?
Did you add it to existing Group Policy or did you create new one. What
level did you add it to? OU or domain or?

Did you test modified command?

net localgroup Administrators domain\HelpDesk /add

Does it work if you logon to a computer with administrative permissions
and run this command? Is HelpDesk group added to local administrator
group?

--
Mike
Microsoft MVP - Windows Security

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1257fmt2bgbq81c@xxxxxxxxxxxxxxxxxxxxx
ok, I went to group policy. Refreshed group policy on the other machines.
I created a startup script to do what you just said, but it seems as if
nothing happened. I even restasrted the workstations, still nothing seems
to be happening.
"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:%23ZJ6eu7aGHA.508@xxxxxxxxxxxxxxxxxxxxxxx
I man, you have to "deploy" this as startup script using Group Policy.

--
Mike
Microsoft MVP - Windows Security

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:12578jqj9mkg6fb@xxxxxxxxxxxxxxxxxxxxx
But then we are startup scripts? Or do you mean add to each and every
machine, that kinda startup script?
"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:eZumSO2aGHA.1536@xxxxxxxxxxxxxxxxxxxxxxx
In this case you can still use Group Policy but in this case you can
use _startup_ script (_not_ logon script) to add e.g. Help Desk group
to local Administrator group on all the computers. The script that you
can use looks like this

net localgroup Administrators domain\HelpDesk /add

domain in above command is netbios name of your domain.

This way HelpDesk will only be added -- without removing any other
groups.

--
Mike
Microsoft MVP - Windows Security

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1255jubreasa613@xxxxxxxxxxxxxxxxxxxxx
well here is the problem. That I am not sure about using Broosters
solution.

We have various admin accounts other then administrator
on some of the client machines, and we do not want to
have it remove those, because some are laptops and they
use those accounts when they login at home. Is there anyway to be
able to keep their current admin accounts also?


"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:ec6NvGwaGHA.4772@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

Brooster posted a solution to your question.

What I would like to add is a warning against using domain
administrator accounts to logon to user computers.
So simply put -- don't use accounts that have domain administrator
permissions for logging on to client computers. Use these accounts
only for working on domain controllers.
For logging on to client computers create new accounts (e.g.
admin-mike, admin-greg, etc) and add them to a group called e.g.
Help Desk. Now add this group to Local Administrator group by using
solution proposed by Brooster.

--
Mike
Microsoft MVP - Windows Security

"RedPenguin" <redpenguin@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1254qjd2uso6j84@xxxxxxxxxxxxxxxxxxxxx
Ok we recently installed Microsoft Server 2003 Enterprise Edition
on our PC. The whole domain is working and everyone has thier own
login that works. The only thing is, those users do not have local
admin privledges on the PCs they logon to.

We wish to have a handful of users, HelpDesk, that when they login
to any machine, they automatically get admin privledges on the
workstation.

We tried playing with Group Policy Editor but nopthing at all will
work.

















.

Relevant Pages

  • Re: Administrator restricted - Control Panel Missing
    ... If you did not specifically set up Group Policy to restrict access to ... The command net users will display user accounts and net user username will ... type of administrator. ... the control panel was missing. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: This operation has been canceled due to restrictions in effect on this computer. When Logging i
    ... Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub: ... >have administrator privileges. ... >> happening on a few computers, other computers get no error messages ... >> fine but I can't figure out why it is trying to startup. ...
    (microsoft.public.windows.group_policy)
  • Re: access denied error when opening gpedit.msc
    ... If you configured Group Policy to prevent users from accessing MMC, ... possible that you did not filter the administrators group assuming you are talking ... If these computers are in an OU other than the domain ... I am logged on with an Administrator account. ...
    (microsoft.public.win2000.security)
  • Re: debugger user autochange
    ... One possibility could be that Group Policy Restricted Groups are being ... applied to the computers in question. ... I think I failed to convey the problem clearly - the user accounts ... domain/userxyz assigned to the administrator group. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Domain Users to have Local Admin rights
    ... We have various admin accounts other then administrator ... administrator accounts to logon to user computers. ... Now add this group to Local Administrator group by using ...
    (microsoft.public.windows.server.security)