Administrator Best Practise

[Daniel S]

Hi All

We have recently changed our IT structure from all engineers know the
administrator password to only a few key members knowing.
How would you recommend I setup groups so IT support staff can log on to W2K
clients and have admin rights without actually putting the IT support
security group into the Domain Admins group? Ideally I know it would be
easier to give support staff the local admin password, the unfortunate thing
is they are different on all clients (a bit of a mess I know).

I presume all I have to do to allow users to be able to logon to servers is
to allow them to log on locally in a GPO.

TIA, Daniel

 

[GT]

Add users (or groups) from AD into the local administrator group on the
machine.

-GT

 

[GT]

You could do it with a GPO via 'restricted groups' setting.

-GT

 

[Daniel S]

Sorry to be so ignorant, how would one go about doing that?