adding user to any local user group after first login

[Chandra via WindowsKB.com]

Hi,

In our domain, we are connected around 100 PCs. except for a user (myadmin),
we have given all other users as domain users power only.

However if any user require admin rights for their PCs we give admin rights
to their user name in that pc through the myadmin user only.

Since some of the users are changing their pcs frequently whenever they ask
admin rights to their PCs we are going to their location and giving admin
rights. We couldn't able to connect their pcs remotely through Dameware
Remote control since their user id is not even in power user group in that
local machine since their are logging to that pc with their ID for the first
time.

So, my question is, is there any way is there so that the user itself add
their user name in any one of the localgroup in that pc ?

Any help highly appreciated.

Regards
Chandra.

 

[Robert Moir]

Hi,

In our domain, we are connected around 100 PCs. except for a user
(myadmin),
we have given all other users as domain users power only.

However if any user require admin rights for their PCs we give admin
rights
to their user name in that pc through the myadmin user only.

Since some of the users are changing their pcs frequently whenever they
ask
admin rights to their PCs we are going to their location and giving admin
rights. We couldn't able to connect their pcs remotely through Dameware
Remote control since their user id is not even in power user group in that
local machine since their are logging to that pc with their ID for the
first
time.

I don't personally think you should be giving out admin, even local admin,
like this in the first place but still...

As I understand your post
* anyone who wants can be an admin
* they don't always use the same machines, they move around a lot

I'm going to propose a different solution based on that - you create a group
in your domain, and this group is added to each workstation's local
administrators group as part of your default build / group policies.

You can then add and remove people from this group on the domain quite
easily, granting them local admin rights on any and all machines without any
further support burden.

 

[Chandra via WindowsKB.com]

Hi Robert,

Thanks for your reply.

I understand what you said. I dont want the user to give themselves as admin
user, rather let they give themselves as a standard user (either in users or
power users group)

Is that possible.

Moreover, as a system engineers, we dont have access to create or do anything
in the server to form a group for this purpose.

Any other solution is appreciated.

Hi,

[quoted text clipped - 14 lines]

first
time.

I don't personally think you should be giving out admin, even local admin,
like this in the first place but still...

As I understand your post
* anyone who wants can be an admin
* they don't always use the same machines, they move around a lot

I'm going to propose a different solution based on that - you create a group
in your domain, and this group is added to each workstation's local
administrators group as part of your default build / group policies.

You can then add and remove people from this group on the domain quite
easily, granting them local admin rights on any and all machines without any
further support burden.