Desktop

Ask something
Question Locked

Disable Local Admin account on all domain computers?

0 helpful
5 replies

by ktoddsd

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I was wondering if there is any way to disable the Local Admin account on all domain computers through GPO or some other automated policy software? Any responses will be much appreciated.

Thanks,
Kevin

5 replies

by ben.rattigan

Make sure you have someone as an Admin first who can access computers.

In the Computer Configuration in your GPO
Expand Windows Settings
Expand Security Settings
Expand Local Policies
Select User Rights Assignment
You want Deny Access to this computer from the network
Select Define these policy settings.
Then you can add Administrator.

I would seriously advise testing this out on a test PC first before deploying to all PC's via GPOs

by manupug

Hello I just tested your instructions and they just do the opposite of what I need. I wanted to block the access to all the local accounts and enable only the AD administrators group. After I run the command gpupdate i cannot longer log in with the AD Administrator credentials but only with the local Admin account. Any clues what is going wrong?
Thanks

by johnmcmasters

Curious which accounts you are trying to disable. Domain Controllers do not have Local Admin Accounts hence it is a Domain Controller.

This discussion is closed to new replies.