Domain security group to All Computer Local Administrator Group

[Techy_Naren]

Hi,

I have a 300+ Workstation and Windows 2003 Domain
All Users needs to have local admin rights on their own desktop,
Users should be able to log on to any computer..altought without admin
rights on other computers

created a local desktop admin security_group on domain.
i Want my desktop admin to have admin rights if they log on to any
computers on network, but they should be normal users and should not
be able to do any thing on Domain controller except changing users
password

I can add this desktop admin group using GPO restricted policy but
problem is that if i configure the restricted policy then it will kick
off the normal users of there local admin group..which i dont want to
disturb thier current previlage

 

[Dmitry Korolyov [MVP]]

This is the correct behavior for Restricted Groups feature. You can create
additional group for your users, add it to Administrators group as well, and
add users who have to have administrative privileges to that group. Or you
can use startup script to add certain users/groups into Administrators group
without kicking off other users.

--
Dmitry Korolyov [[email protected]]
MVP: Windows Server - Active Directory


Hi,

I have a 300+ Workstation and Windows 2003 Domain
All Users needs to have local admin rights on their own desktop,
Users should be able to log on to any computer..altought without admin
rights on other computers

created a local desktop admin security_group on domain.
i Want my desktop admin to have admin rights if they log on to any
computers on network, but they should be normal users and should not
be able to do any thing on Domain controller except changing users
password

I can add this desktop admin group using GPO restricted policy but
problem is that if i configure the restricted policy then it will kick
off the normal users of there local admin group..which i dont want to
disturb thier current previlage