Add global group to local admistrators Group

[Jim]

When adding windows clients to a domain the domain admin group is added to
the local Admistrators group of the client computer. Is there a way to set
up the server so that as client computers are added to the domain not only
is the domain admin group added to local administrator group, but, some
other group is added at the same time automatically?

Thanks.

Jim

 

[Richard Moreno]

Hi Jim-

You could use the restricted groups via GPOs. See below:

http://support.microsoft.com/default.aspx?scid=kb;en-us;279301
http://support.microsoft.com/default.aspx?scid=kb;en-us;320045

--
Thanks,
Richard Moreno
MCSE NT4\2000\2003
MCSA 2000\2003

*This posting is provided "AS IS" with no warranties, and confers no
rights.

 

[Jim]

I don't see how this will accomplish what I want. What I am after is I need
a group of users to have administrative access to all clients in the domain
but I do not want them to have all the rights that domain admins have.
Maybe I just don't understand group policies enough to get it. If this is
still a way to do it could you elaborate a little more.

Thanks for your response, Richard.

 

[Richard Moreno]

Hi Jim-

Dependant on where you link your GPO is where the control you will give
those users or groups assigned in the Restricted Group Policy. So, if you
have ALL client workstations in an OU named "Workstations" then you create a
GPO, edit the Restricted Groups info, link it to "Workstations" and all
members of that 1 OU will change the Admin group as the GPO dictates. So,
whomever you gave access to will have admin access to the workstations as do
the Domain Admins group, but not to anything else in the domain.

--
Thanks,
Richard Moreno
MCSE NT4\2000\2003
MCSA 2000\2003

*This posting is provided "AS IS" with no warranties, and confers no
rights.