|
Posted by Blackhole on May 4, 2006, 10:18 pm
Please log in for more thread options Easy. I discovered this one by accident . Follow what Brooster said, but
instead of adding domain\domain admin , leave the domain name portion off
and add jsut the name of the local PC account you want to be a admin. GPO
does not check to see if it is a valid name or not.
After that, if that local account name is added to the local admin gropup on
a PCPC, GPO will not delete that name when it is applied AND it dfoes not
automatically grant it admin access (as it would for DOMAIN\DOMAIN ADMIN
names) to any PC until you add it to the local PC admin group.
> well here is the problem. That I am not sure about using Broosters
> solution.
>
> We have various admin accounts other then administrator
> on some of the client machines, and we do not want to
> have it remove those, because some are laptops and they
> use those accounts when they login at home. Is there anyway to be able to
> keep their current admin accounts also?
>
>
>> Hi,
>>
>> Brooster posted a solution to your question.
>>
>> What I would like to add is a warning against using domain administrator
>> accounts to logon to user computers.
>> So simply put -- don't use accounts that have domain administrator
>> permissions for logging on to client computers. Use these accounts only
>> for working on domain controllers.
>> For logging on to client computers create new accounts (e.g. admin-mike,
>> admin-greg, etc) and add them to a group called e.g. Help Desk. Now add
>> this group to Local Administrator group by using solution proposed by
>> Brooster.
>>
>> --
>> Mike
>> Microsoft MVP - Windows Security
>>
>>> Ok we recently installed Microsoft Server 2003 Enterprise Edition on our
>>> PC. The whole domain is working and everyone has thier own login that
>>> works. The only thing is, those users do not have local admin privledges
>>> on the PCs they logon to.
>>>
>>> We wish to have a handful of users, HelpDesk, that when they login to
>>> any machine, they automatically get admin privledges on the workstation.
>>>
>>> We tried playing with Group Policy Editor but nopthing at all will work.
>>>
>>
>>
>
>
| 
XML Sitemap