Windows Forum

Ask something
Discussion Locked

Group Policy

0 helpful
8 replies

by sameh fouad

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I administer a Windows 2003 domain, when I want to make the user a restricted, power user or an administrator on his PC, I have to log on to his machine locally and do this, Can I configure the Default Domain Policy to make this centrally but I want to remain as an administrator on all machines?

8 replies

by entawanabi

You will have to go to the people who own the system and employ you to get permission to change thios practice as they are most likely the ones who require this security measure.

by davebkelly

One way around this is to use user groups. Its a pain in the first instance but it pays in the long run.

What you do is create 2 or 3 groups in your AD. I will call them locAdmin, locPower and LocRestrict here. Then you add these groups to the appropriate local groups on the client machines.

Once this is done, all you need to do is add the user to the appropriate group to give them the local group admission.

i.e. user JSMITH is in Domain Users and LocRestrict but he now needs power user rights. All you need to do is go into AD U & C and add him to the LocPower group........ a quick log off / on again will do the trick and you dont have to bother to visit the desktop.

With regards to you always being a local admin, just add yourself to the Locadmin group.....

This discussion is closed to new replies.