General discussion

Locked

dont add domain admins group to the local administrator group

By alashhar ·
You know when we add a computer as member in a domain, by default ?domain admins group? will add to the ?local administrator group? of the computer, my boss asked me if we can change this policy where we create a new security group in the domain and add some IT staff as members in this group, and enforce the new computers which will be add to the domain to add this group to their local administrator group automatically instead of adding domain admin group.

This conversation is currently closed to new comments.

9 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by ewgny In reply to dont add domain admins gr ...

You should have and leave the Domain Administrator group as a member of the Local Administrator Group
I do suggest however that you add another "Tech" group to the local administrator group as well, so that you can adjust the people that you want as local administrators, by adjusting the membership of the Domain based global "Tech" group.
I add my "Tech" group to the local Administrators group prior to imaging, so that all workstations contain the tech group as a member of the local admin group

Collapse -

by ewgny In reply to

You can also use "restricted groups" within group policy to control membership of local groups
http://tinyurl.com/bwtkc

Collapse -

by BFilmFan In reply to dont add domain admins gr ...

Domain Admins are added automatically to a system when it is added to a domain.

Advise your boss that an Active Directory expert advised him to keep managing and ceasing making unqualified technical decisions without further training.

Collapse -

by alashhar In reply to

i think u miss understand the question, by other way how i can add any domain group to the local administrator group of computers that are member of the domain using GPO, so any computer injoin to domain automatically this domain group will add to local administrator group

Collapse -

by CG IT In reply to dont add domain admins gr ...

well if you remove the domain admins from the local machine admins, domain admins can not manage the local machine. If the boss wants to keep his computer secure, there are other ways to go about it [but one tends to wonder now, whats he got on there that he wants to hide?].

I'm with Bfilmfan. I have to remember that one.

Collapse -

by alashhar In reply to

i think u miss understand the question, by other way how i can add any domain group to the local administrator group of computers that are member of the domain using GPO, so any computer injoin to domain automatically this domain group will add to local administrator group

Collapse -

by sgt_shultz In reply to dont add domain admins gr ...

take bfilms advice, (not) this is why we are getting beat out of our jobs.
you have opportunity. you have been invited to teamwork. lucky you. sounds like you understand this.
maybe you can stick your neck out a little and tell boss, i don't know but i sure would like to know. can i look into it and get back to you shortly?
then if yes you call microsoft and ask them what it will take to get a support tech to answer this for you AND your boss. you might find you can get free help. but if not, take the dollar figure back to your boss and ask if ok for you to spend it to implement the fix and of course you will report back with what you have learned. you may have to put up with boss at your elbow but mayb not if you promise to report back in full. you can get some free training now. and not from us. we worth what you are paying us, see?
you can get so much valuable help right from the real authority. free training for you and boss gets what she asked for. boss is always right. even when wrong. just play it like you would want it if you were the boss. if you don't like having a boss, too bad because ya gotta. perhaps nicer if you can become boss, but not with non-cooperation tactics.

Collapse -

by sgt_shultz In reply to

how i got happy by making boss happy:
my normal reaction is like bfilm: get the heck out of my area and trust me to do my job.
that got me an untrusting boss who got in my area a lot. i wanted to fix that but i didnt' know how. i am sorta contrarian by nature, also masochistic, i tried to fix by doing what i really didn't want to do. i listened to boss and did what he asked me to do. i took pains to acknowlege that he helped me out when he did, which turned out to be frequently. this is where it helps to be masochist. oh, the pain...
'i am good at finding out answers and you help me figure out the right questions.' first few times out those words stuck like peanut butter in my throat, i gagged a bit but boss too astonished to notice. don't flatter. see if you can really find some value. maybe she start doing the same for you. on your review even.
i get requests from boss, i turn my full attention to her. i say 'ok'. i ask how hot is it? then i say, i will do <the thing> by <the deadline> and give u a status report. then i do it. or if i don't understand i say, let's talk? and we do. it is easy to get a boss to talk, isn't it?
my boss used to be all over me. now i work to find out what he wants and i do it fast as i can.
now he stays way out of my area because he likes doing his boss thing which is waving me like his magic want over the problems. fun for him and me too. turns out, incredibly, he wants same thing as me: to leave me alone mostly. he actually rather work on other stuff! turns out he was just in my area because my interactions with him led him to believe he had to keep check on his rearend smoke detector. i get to spend more money too. on easy street now. i spend what i need to fix it so i can get back to standing on soapbox in tech republic
i try to remember to say 'thank you' at end of most interactions. they relexively say thank you back, which i enjoy.
R-E-S-P-E-C-T....sock it to em sock it to em sock it to em sock it too em

Collapse -

I know this post is dead, but this really caught my eye.

by rambuswolf In reply to

When I first read sgt_schultz' reply, I was like, "Whatever," and I almost didn't finish reading it (also the punctuation and grammar made it a little bit difficult to follow the continuity). But then I read it through, and the thing is, it's brilliant.

I don't know if it works exactly like that for every boss (mine is actually very difficult to have a conversation with because, like clockwork, he listens for five seconds and then interjects an unrelated demand), but the spirit of the argument is exactly correct.

I think there is definitely a time and a place for other posters' suggestions of, "Back the **** off because you don't know what you're talking about," and maybe the OP's situation is one of them, but I think it's too easy for us as IT people to take that route or to barely veil that sentiment - and it does show - when we deal with bosses and users.

Wow, I just managed to resurrect a dead post AND assist in threadjackig it.

Back to Windows Forum
9 total posts (Page 1 of 1)  

Related Discussions

Related Forums