|
Posted by Roger Abell [MVP] on April 29, 2006, 3:39 am
Please log in for more thread options What Brooster posted only works when you are OK with having
all machines that are with scope of the GPO carrying the Restricted
Group definition for Administrators have identical membership for
their local Administrators group.
This is quite often not possible.
If all of the machines are current versions of Windows at latest
service pack, then one can do an inverted form of using Restricted
Group. Say you have a custom domain group HelpDesk. If in a
GPO linked to OU containing (somewhere) within (subOU structure)
the machines on which HelpDesk should be in the local Administrators
group you define a Restricted Group definition, not for Administrators
but for HelpDesk. Now, the trick is that you do not set anything in
the Members list of the Restricted Group definition but you do set
Administrators in the Member Of list. When that GPO applies to
the subjected machines HelpDesk will be added to Administrators
and what was already in Administrators will remain.
However, keep in mind that GPO application is driven by change,
that is, GPO is reapplied when it is seen the GPO has changed.
The result from this is that if a local admin alters the membership
it will stay altered until the GPO is reapplied. There is a policy that
causes GPOs to be applied always, even if no change has happened,
but keep in mind this will cause work and network traffic approx
every 90 minutes per machine.
Take a look at
http://support.microsoft.com/kb/810076
but do not be put off by the article title (which is slightly inaccurate)
> well here is the problem. That I am not sure about using Broosters
> solution.
>
> We have various admin accounts other then administrator
> on some of the client machines, and we do not want to
> have it remove those, because some are laptops and they
> use those accounts when they login at home. Is there anyway to be able to
> keep their current admin accounts also?
>
>
>> Hi,
>>
>> Brooster posted a solution to your question.
>>
>> What I would like to add is a warning against using domain administrator
>> accounts to logon to user computers.
>> So simply put -- don't use accounts that have domain administrator
>> permissions for logging on to client computers. Use these accounts only
>> for working on domain controllers.
>> For logging on to client computers create new accounts (e.g. admin-mike,
>> admin-greg, etc) and add them to a group called e.g. Help Desk. Now add
>> this group to Local Administrator group by using solution proposed by
>> Brooster.
>>
>> --
>> Mike
>> Microsoft MVP - Windows Security
>>
>>> Ok we recently installed Microsoft Server 2003 Enterprise Edition on our
>>> PC. The whole domain is working and everyone has thier own login that
>>> works. The only thing is, those users do not have local admin privledges
>>> on the PCs they logon to.
>>>
>>> We wish to have a handful of users, HelpDesk, that when they login to
>>> any machine, they automatically get admin privledges on the workstation.
>>>
>>> We tried playing with Group Policy Editor but nopthing at all will work.
>>>
>>
>>
>
>
| 
XML Sitemap