Windows XP Pro SP2 on a Windows Server 2003 Std domain with Active Directory.

When I set up a new computer I log in as domain admin to add "Domain Users"
to the administrator group on the Windows XP client to make them a local
admin. Does this actually restrict administrative access for domain users to
local admin access on the local computer, or, are they getting domain admin
access too?

Dennis

Dennis wrote:
> Windows XP Pro SP2 on a Windows Server 2003 Std domain with Active
> Directory.
>
> When I set up a new computer I log in as domain admin to add
> "Domain Users" to the administrator group on the Windows XP client
> to make them a local admin. Does this actually restrict
> administrative access for domain users to local admin access on the
> local computer, or, are they getting domain admin access too?

You added them to the Local Group "Administrators".
That is the LOCAL group. That affects things on that LOCAL computer.

Although - that seems like a horrible idea - to make all domain users admins
on their local machine. Semms like you would be creating work instead of
helping in most cases.

Note - it means they also have control of every other machine remotely -
since they are members of the local admin group there too.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

Hi Shenan:

The procedure I described is what my network consultant told me to do. I
agree with your assessment. What would be the correct way be to handle
domain users as local computer admins?
--
Dennis


"Shenan Stanley" wrote:

> Dennis wrote:
> > Windows XP Pro SP2 on a Windows Server 2003 Std domain with Active
> > Directory.
> >
> > When I set up a new computer I log in as domain admin to add
> > "Domain Users" to the administrator group on the Windows XP client
> > to make them a local admin. Does this actually restrict
> > administrative access for domain users to local admin access on the
> > local computer, or, are they getting domain admin access too?
>
> You added them to the Local Group "Administrators".
> That is the LOCAL group. That affects things on that LOCAL computer.
>
> Although - that seems like a horrible idea - to make all domain users admins
> on their local machine. Semms like you would be creating work instead of
> helping in most cases.
>
> Note - it means they also have control of every other machine remotely -
> since they are members of the local admin group there too.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>