Local Admin

[Paul]

I am currently setting up delegation of administrative
control at my workplace. I am doing this to cut down on
the number of people that are in the Domain admins group
that don't need to be.

The problem I have, is some of the people that need to be
removed from the default Domain admins group need to have
privileges to install software on users local machines
when there on jobs.

We have 1000 + computer and we are running Windows 2000
with Active Directory in a Mixed mode.

I don't want to have to add them to the local admins group
on each machine, as I would be there next Christmas with
1000+ computers. And if I could avoid them having to log
on locally each time as administrator that would be good.

So I was wondering if someone knows of an easy way of
doing this without giving to much administrative control,
or keeping them in the Default Domain Administrators group.

Any advice would be good advice

Thanks

Paul

 

[Steven L Umbach]

Hi Paul. You could use "restricted groups" to accomplish this. Create an
Organizational Unit and put the computers in the OU that they need to be
local administator on. Create a new GPO for the OU and configure restricted
groups for the administrators group. Add the domain admins and any other
users or groups that need to be local administrators on those machines. Do
NOT do this at the domain level, or they will end up being domain
administrators. Be sure to implement a test setup before rolling out. ---
Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;228496
http://support.microsoft.com/default.aspx?scid=kb;en-us;320045