Group Policy vs Local Admin

[joshua.raymond]

I noticed a few threads regarding this, however, I am receiving
contradicting results. I am applying group policy to network
connections (specifically so they can't enable/disable them), but it
would appear that local admin status on the machine supersedes my group
policy imposed will. Is there a way to force the group policy changes
to ignore their local admin rights and apply the change?

Thanks

Josh

 

[Darren Mar-Elia \(MVP\)]

What policy specifically are you setting?

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related
And, the Windows Group Policy Guide is out from Microsoft Press!!! Check it
out at http://www.microsoft.com/mspress/books/8763.asp
GPOGUY Blog: http://blogs.dirteam.com/blogs/gpoguy

 

[joshua.raymond]

This pertains to most of what is under User Configuration->Admin
Templates->Network->Network Connections.

The most important of these are probably:

Ability to enable/disable a LAN connection
Prohibit Enabling/Disabling components of a LAN Connection
Prohibit access to properties of a LAN connection

 

[Darren Mar-Elia \(MVP\)]

In reading through the explain text on those policies it appears that it
explicitly says that, for example, the "ability to enable/disable a LAN
connection" policy setting does not apply to local Administrators unless you
enable another policy. The explain text says,

If you disable this setting (and enable the "Enable Network Connections
settings for Administrators" setting), double-clicking the icon has no
effect, and the Enable and Disable menu items are disabled for all users
(including administrators).


--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related
And, the Windows Group Policy Guide is out from Microsoft Press!!! Check it
out at http://www.microsoft.com/mspress/books/8763.asp
GPOGUY Blog: http://blogs.dirteam.com/blogs/gpoguy

 

[joshua.raymond]

Yea I tried that prior, but it went too far.. I see that I made a
mistake else where to cause that to happen though. On the sub-OU I can
just disable that and attain my desired effect. Thanks for the advice.

Josh