Force adds to Administrators local groups via OU??

[Richard Roche]

I would like to add users or groups to the local machine's Administrators
group if it belongs to a particular OU. I'm not a domain admin, so I can't
rely on the {domain}\Domain Admins group for administrative access. I would
like to avoid touching each machine or even connecting via MMC to each to do
this. Can this be done via scripting or OU-level GP?

Thanks in advance for any help.

Ric Roche

 

[Cary Shultz]

-----Original Message-----
I would like to add users or groups to the local machine's Administrators
group if it belongs to a particular OU. I'm not a domain admin, so I can't
rely on the {domain}\Domain Admins group for

administrative access. I would

like to avoid touching each machine or even connecting via MMC to each to do
this. Can this be done via scripting or OU-level GP?

Thanks in advance for any help.

Ric Roche


.

Rich,

Take a look at Restrictive Groups ( GPO ).

HTH,

Cary

 

[David]

If you have a group policy linked to the OU in question,
you can then setup a "restrictive" group in the policy to
force the membership of the group. It's possible to
force the membership to be empty, so be careful what you
ask for...

See: http://support.microsoft.com/default.aspx?scid=kb;en-
us;320045

There are also third party tools that allow further
control over local groups and accounts.

-----Original Message-----
I would like to add users or groups to the local machine's Administrators
group if it belongs to a particular OU. I'm not a domain admin, so I can't
rely on the {domain}\Domain Admins group for

administrative access. I would