Domain Users with Administor Rights to XP

[Darrin Kirby]

We have users that change pc's from day to day. I need
them to login to any Windows XP Pro workstation with a NT
4.0 Domain account. That account needs to have
administrative rights on the Windows XP Pro client. We
have 100+ apps installed on each of the XP Workstations.
Most of the Apps are not XP aware. Most do some sort of
automatic update and install with zero to little end user
intervention. Users need to have Administrator Rights in
order for updates to complete without errors. I dont want
to add an account for every domain user to every XP
workstation and make them administrators. How can I
automaticly make every domain user have administrator
rights on XP workstations(without setting up individual
accounts on the XP workstations). I know it is not secure
but I have no choice. I need XP to work like Win98.

 

[Colin Nash [MVP]]

Add the Domain Users group to the Administrators group on each workstation.

You should be able to do this remotely from your workstation using the
Computer Management MMC or a third-party tool like Hyena.

There are some tools to do it all automatically in a big batch process but I
can't think of the names right now.

Anyway, you don't need to add each individual username to each workstation's
Administrators group.

An even better way is to make a global group on the domain called "Local
Administrators" (or whatever you want) and then add your users into that
group. This way, if you ever want to remove some people's local admin
access, you can just remove them from this group. It gives you more
flexibility.

 

[Torgeir Bakken (MVP)]

(snip) How can I
automaticly make every domain user have administrator
rights on XP workstations(without setting up individual
accounts on the XP workstations). I know it is not secure
but I have no choice. I need XP to work like Win98.

Hi

We add "NT Authority\Interactive" in the local Administrators group
to let all domain users automatically be local admins when they log
on to a computer interactively.

This is more secure than adding "Authenticated Domain users ",
"Domain Users" or "NT AUTHORITY\Authenticated Users" because you
avoid the issue with cross network admin rights (remote access)
that these groups introduces.