Group in AD to controle who has local admin rights?

[Freddy Ulvseth]

Hi,

Is it possible to make a group in AD which contains those users who has
local admin rights on their PC's?

My thinking is to have a group where i can add a user if he needs local
admin rights for upgrade of programs or something, when i want to remove his
admin rights, i take him out of this group.

after some reading and grubling, i cannot find any sollution for this,

anyone else has a sollution like this?

All the best,
Freddy Ulvseth.

 

[Freddy Ulvseth]

Hi,

Is it possible to make a group in AD which contains those users who has
local admin rights on their PC's?

My thinking is to have a group where i can add a user if he needs local
admin rights for upgrade of programs or something, when i want to remove his
admin rights, i take him out of this group.

after some reading and grubling, i cannot find any sollution for this,

anyone else has a sollution like this?

All the best,
Freddy Ulvseth.

Ahh.. found it..

- Make a security group in AD
- Add that group to the local admin group on computers..

And, now i want to find out how to set this as default on all computers in
domain.. (about 70 pc's)

Best reg.
Fred.

 

[Guest]

You can set this using the restricted groups feature (part of computer
configuration GPO). Remember that this is a replace, not a merge (by
default). So include anything already in the administrators group when
defining the restricted group.

-- http://support.microsoft.com/?id=279301
-- http://support.microsoft.com/?id=810076


--

Paul Williams

http://www.msresource.net
http://forums.msresource.net

 

[Freddy Ulvseth]

Ahh.. great.. thanks.
I'll look into this..

I was planning about using kix script, but this might be easyer..

best reg. Fred.

"ptwilliams" < wrote in message

 

[ptwilliams]

A script's another way of doing it of course. You could quite easily do it
with a computer startup script (runs under SYSTEM account) and one line
batch file saying something like 'net localgroup groupName member /add'


--

Paul Williams

http://www.msresource.net
http://forums.msresource.net


Ahh.. great.. thanks.
I'll look into this..

I was planning about using kix script, but this might be easyer..

best reg. Fred.

"ptwilliams" < wrote in message