Desktop
by malmc37 Accepted solution
by ashij Accepted solution
Hi! MalMc,
First of all, I am just curious to know if you are a Network Admin or someone who has permission to do such a thing. Second, by IT Users, do you mean the users in the Domain or the IT Group users. I have the solution, but I would like to know these things first, just to make sure I give you the right instructions.
-AJ
by cg it Accepted solution
only members of the administrators security group, or those delegated the authority, can make changes.
domain users are restricted user accounts
by malmc37 Accepted solution
by david.wallis Accepted solution
you need to put them in a different group and seriously limit their permissions if you dotn want them to be able to access AD. once you have locked down the permissions, put them in a group and apply a group policy to stop them from getting into places you dont want them.
or if worst comes to worst take them to one side............... :)
what permissions and groups are they currently in?
by malmc37 Accepted solution
by dhuffine Accepted solution
To the Domain Controller? Or To the PC's they use?
If you go into the AD, find your Groups OU then find AdminsGroup (and anything else you may have created) open that and click on "Members" make sure they are not listed in there. This will restrict there admin rights across the network though (unless they have themselves added as local admin to any of the other PC's)
Next open up there individual User and go to "Member Of" and make sure they are not listed as a "Enterprise Admin" or "Exchange Admin" or "Schema Admin" or anything like that. If you do not want them to have anything other than normal user rights then all they need to be able to login and do there work is "Domain User" listed there. Creating a new OU and setting up the permissions on that, and creating a Group Policy is fine and dandy but to be safe you want to make sure there not apart of any membership they need not be, because sometimes one will overwrite the other if they clash.
by cg it Accepted solution
local machine administrators [PCs] do not have any authority in a domain environment. They shouldn't even be able to log on to the domain as the account would not exist in AD.
A DC has it's own security [GPO linked to it's OU] which further restricts who can log if you used the hisecdc security template.
So, either you have a serious breech in security, or you need to clarify what really is going on.
by malmc37 Accepted solution
by cg it Accepted solution
if you created a GPO that effectively makes domain users, domain administrators, then you've messed up.
if you made domain users also memebers of the power users group, they can do a lot of things.
if you want users to be able to install software on their PC without you knowing it.... well, that's a security risk...
you can provide software to users using Group Policy without having to grant them the right to install software.
This discussion is closed to new replies.
Sort by Trending