Windows

The main thing is that anyone at the console-- i.e. the laptop itself, has Full Control. The 'Sharing' tab controls access from the network only, while the 'Security' tab controls the NTFS permissions on the hard drives themselves. So, if a user is accessing the drive over the network, they will be restricted, but if a user is sitting in front of the laptop typing on it, they will not be.

Another thing you want to look at as well is if you only want domain admins accessing the c drives remotely then do nothing with the laptops as far as sharing is concerned. By default Windows NT, 2000, XP all add what is called admin shares that are hidden. For example \\computername\c$ is the default share for the C drive and all other drives are shared as well with the exception of the CDROM. The default share permissions are set for administrators of the local machine to have access only. By default joining the pc to the domain puts the domain admins in the local administrators group. Doing it the way you are describing has no risk but it is a lot of unnecessary work.

This question was closed by the author