Windows Forum

Ask something
Discussion Locked

domain user as local admin?

0 helpful
4 replies

by yp

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Normally, in the past, i set up a user say fredx as an administrator for
the PC - i then use this same user name to be their login for the domain
and set them up for that.

This ensures that users cans set up their own applications on their PC's.

This does pose some problems if more than one person logs on to that PC as
each person will be an administrator for that PC.

What other ways may be preferable to set up users on domain and also have admin rights to local machine?

4 replies

by sba.afghani

it will be difficult to go and do this on each machine, I am thinking is there any easy way to just implement it on AD and all machine should take effect at once.

by yetanotheradmin

Not quite sure what you?re looking for here, the way I see it you have 4 options.

1. Give all users the password for the local administrator account. This is less dangerous than giving their domain account local admin rights as they will be specifically logged on as admin to use admin rights and if they mess up big time and lock out domain admin, you can use a linux boot disk to reset the local admin password. Obviously the smarter ones will give their domain accounts local admin rights anyway!

2. Add individual domain accounts to the local administrators group on specific clients. Risks similar to above.

3. Create a domain group, add the users you wish to have local admin rights on computers and add them to the group, then on each client, add the domain group to the local admin group.

4. Ask yourself why on earth you?d want to give them local admin rights, change your mind and live happily ever after.

Go with 4, you can't lose!

by razz2

Go with YetAnotherAdmin's #4!!!!!

Ok, I feel better now. If for some reason it must be done then follow basic networking standards. One of the main resons for a "Domain" is central admin. Create all accounts at the domain level and then assign domain users to a domain group. Lets say "WorkstationAdmins" group. Add groups from that domain into local workstation groups. Then assign permissions to the local group.

But ask yourself why? Why? WHY? An end user with admin perrmisions has the keys to the kingdom. Hacking, Spyware, Adware, P2P, Virus' etc are all more likely when admins are logged in. In real practice most 'good' IT people don't recommend login as admin for a normal user account. They have a standard user account and when they need the power for something they log off and log in as their seperate admin account.

Good luck,

razz

This discussion is closed to new replies.