Correct way to set up local computer administrator access

[Guest]

Windows XP Pro SP2 on a Windows Server 2003 Std domain with Active Directory.

When I set up a new computer I log in as domain admin to add "Domain Users"
to the administrator group on the Windows XP client to make them a local
admin. Does this actually restrict administrative access for domain users to
local admin access on the local computer, or, are they getting domain admin
access too?

Dennis

 

[Shenan Stanley]

Windows XP Pro SP2 on a Windows Server 2003 Std domain with Active
Directory.

When I set up a new computer I log in as domain admin to add
"Domain Users" to the administrator group on the Windows XP client
to make them a local admin. Does this actually restrict
administrative access for domain users to local admin access on the
local computer, or, are they getting domain admin access too?

You added them to the Local Group "Administrators".
That is the LOCAL group. That affects things on that LOCAL computer.

Although - that seems like a horrible idea - to make all domain users admins
on their local machine. Semms like you would be creating work instead of
helping in most cases.

Note - it means they also have control of every other machine remotely -
since they are members of the local admin group there too.

 

[Guest]

Hi Shenan:

The procedure I described is what my network consultant told me to do. I
agree with your assessment. What would be the correct way be to handle
domain users as local computer admins?