Domain Global Groups in Workstation Local Admin Groups
From: George (George_at_discussions.microsoft.com)
Date: 08/25/04
- Next message: Mike Bright MSP: "Re: MiniDump"
- Previous message: Mike Bright MSP: "Re: service pack 2"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 25 Aug 2004 10:41:07 -0700
Hello all,
We have functional software Admins, that are responsible for End user
support on workstations where their software installed.
I want to create Global security groups, and populate the workstations local
administrator's group with these Global Security groups. This is easlily
done with GPO using restricted groups policy.
My problem is that I only want our functional software admins to have admin
rights on the workstations that have been identified as needing there
software and support.
Our OU structure for computers is based on Geographical Location. Our users
are structured by department.
Some of the functional software admins need to administer workstations that
cross both geographical, and departmental ou structures. This rules out
creating GPO's and applying them to the entire OU without filtering.
I applied the GPO Restricted Groups policy's at the root of the workstations
OU structure so that all computers would process the policy.
I then created global security groups for the computers that would be
managed by the different functional admins. I also create a matching global
admin security groups that contains the different functional admins usernames
for us in the local administrators group.
I planned on using GPO filters, allowing the restricted groups GPO's created
for each functional administrator to apply to systems that are in their
respective Computer security group. By doing this I could just add a
computer to the computer global security group, and the GPO would apply the
global admin group to the local administrator groups on the workstations that
match the filter.
My problem is that a workstation may need multilple global admin security
groups as local administrators, because the end user has applications that
are managed by different functional admins. Only the first GPO linked to an
OU applies its restricted group policy. This is documented on tech
net(810076). So even though the GPO applies, after checking its filter, only
the first restricted group gets updated on the workstation. Each GPO as it
applies overwrites the settings of the other, rather than applying all GPO
restricted groups policies to the workstation.
Has anyone found a way around this?
Thanks
- Next message: Mike Bright MSP: "Re: MiniDump"
- Previous message: Mike Bright MSP: "Re: service pack 2"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
