a_carling said:
I have set up up a domain and users can login in to the domain as standard
(power) users. This does not allow the user to make changes to programmes
and settings on the local machine. Is it possible to log a user on as a
standard (power) user on the domain but still have administrator rights on
the local machine?
Yes, just add their domain account to the "Local Administrators" group -
they remain having the same domain priviledges but gain Admin rights to the
computer. Be sure you have some policies in place either in Group Policy
and written/signed policy (if no Group Policy for that item exists) by each
user, so if they start causing you more work, you can go to your/their
manager's as necessary for discipline as needed. I'm assuming these users
are like IT developers that have software that require elevated priviledges
in order to do their jobs - correct? Normal users shouldn't have that type
of access or you are going to always be busy fixing/reimaging the
PC's/Laptops, and wait until they start taking their PC's out of the Domain
to join their home workgroup (so they can use their home network to work
from home on the company's VPN), not realizing they just broke trust with
the domain and it is going to take you to rejoin the PC/Laptop to the
domain, and not knowing they can still login using cached credentials and
use resources on their home network to work from home via VPN. All these
things you need to consider and give documentation or policies on to prevent
more work on your part.
