GPO to restrict users from changing domain membership

[allen.ferdinand]

I have about 150 remote users who have a tendency to remove their
laptops from the domain when they decide to hook their home computer to
their laptop. This has happened 12 times despite repeated warnings.


Is there a way via group policy to remove the ability of the user to
change their domain membership? PC Anywhere to a laptop on a 28.8 line
in Ireland is a real hassle.


thanks,
Allen

 

[Senthil Prabakaran]

Removing local admin privileges would stop that. However, if some
applications need higher privileges, they might not run properly.

Senthil

 

[allen.ferdinand]

started out that way, just for reasons such as this. They petitioned
to get rights. Right now, I punish them by forcing them to return the
laptop to the USA from whereever they are, but I can't get away with
that for much longer.