Windows Forum
Hi,
how can i restrict the Win2k domain users who are the members of the administrators group to the local computers(Win2k pro clients) to share/unshare and change the security permissions of the local system disks, folders and files.
Thanks.
Parameshwar
by erikdr
Basically NOT, a local admin is omnipotent.
However you could analyse carefully whether in your situation the general rule, that the domain admins group becomes member of the local admins group on each W2K Pro workstation, is needed. Maybe you could split up:
* Make the domain admin group member of the local Power Users (or similar) group on each W2K Pro workstation
* Make sure this group has the essential rights (e.g. installing sw) but not changing shares and security permissions.
* However DO provide a backdoor so that some central authority has the local admin right, unless you really want to remember thousands of different local Administrator accounts passwords. E.g. create a domain group 'WS Admins' and make only a few people (not all domain admins) member of it, and make this domain group member of the local admins group on each W2K Pro workstation.
At your service,
- The Netherlands
This discussion is closed to new replies.
Sort by Trending