Windows Forum

Ask something
Discussion Locked

Restrict Local Admin from Domain rights

0 helpful
8 replies

by parameshst 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi...

I have given my Domain Users(Win2k)the admin rights to their local systems(win2k pro) by going to Active Dir users and comps-->computers-->right click on the client computer --> manage--->groups and the added the user of that system to the administrators group so that they can manage their system for installing software, iis admin,...etc.
Now the users are able to change the security settings on the local drives. They are infact able to get access to add or remonve domain users permisions settings without entering the domain password.
Probably the Domain Admin rights are inherited to the local Admin group.
How to over come.

Any ideas... please help,

Thanks & Regards,
Parameshwar

8 replies

by jaystar

When you add someone to the Admnistrators group of the local machine, they re allowed to add and remove and domain user to any local gruop on the machine. They are also allowed to install any services or software that they wish. Administrative rights on a domain machine, even a client, is dangerous as there are many ways for the end user to then elivate their rights to a domain admin.

I would look at instead giving them power user rights, which allows them to install software, stop and start services, but they can not change the group memberships of the machine by default.

If you need more help, or have a specific case, feel free to contact me.

Jay

by parameshst

Thanks for your views. I have already tried what to think, making Power users. But the problem is that the users will be able to install all software. I want them to install even the junkest software available. I have went through this issue for thepast couple of weeks.
I had posted about the same here, got some answers but did not solve the purpose.
Kindly go through the Questions I had posted prevoiusly and the tried out answers.
You can find them in the previous 25 to 50 questions list.

Thanks... hope you will get back to me.

Parameshwar

by beermonster

Hi,
Can I say first off that it's a bit ridiculous to be concerned about security while at the same time giving your users the right to load any software they like - however virus ridden or poorly designed that software might be... But hey, it'syour network....

Now, I haven't tried this, but I don't see why it wouldn't work. There are a couple of ways to install apps, you can use the applications executable, or you could go to add remove programs in control panel and install them that way. What I suggest is that you give your users the ability to open up the add remove programs wizard using an admin account, while making their actual user account no more powerful than a basic user. You can do this by using the runas command, whichallows you to run a process as another user. To get this to work you will need another favourite of mine, the encrypted VB script. This script will be used to launch the add remove programs wizard without letting the users know what the admin password is. I can send you a sample of a script if you want to test this idea - mail me at darthurs@hotmail.com

The only downside I can think of - apart from the cleaning up you are going to have to do when your users have finished loading their machines with potentially damaging junk - is possible conflicts where the app is loaded for the admin only, nothing that can't be worked around I should think.....

by beermonster

BTW, your comment - 'Probably the Domain Admin rights are inherited to the local Admin group'
Its actually the othjer way round. Domain admins have rights on a machine because they are members of the local admins group. If you removed them from that group, they would have no more power than a basic user. That's why adding your users to the local admin group gave them the same rights as domain admins.

by shmaltz

Remove them from the Local Admin Groups, and create a Group Policy that allows them to install software.

This discussion is closed to new replies.