Re: New computer added local user to have admin privs How?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Pat Horridge (pat_at_remove-spam.vet.co.uk)
Date: 11/16/04


Date: Tue, 16 Nov 2004 14:34:15 -0000


Well been running SBS since V4 so well over 5 years now for 10 users and the
IT support I have do do at desktop level is almost zero. (only really need
to visit workstations to do routine checks)

The work I need to do on the server is only hours per month (unless there's
a hardware problem or software update)
I know this isn't the way others work but my staff are all highly IT
literate and responsible and it works for us.
Like I say I do re-consider it every now ant then but if it aint' broke
don't fix it.

"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmail.atyahoo.com> wrote in message
news:%23Lo4qW%23yEHA.3844@TK2MSFTNGP12.phx.gbl...
> Pat Horridge wrote:
>> I operate a low IT support setup with all users having full local
>> admin rights.
>
> That can lead to *a lot* of extra IT support ;-)
>
>> On the new machine without admin rights setup. The start menu is
>> missing items. Word Outlook and excel fail to launch as they need to
>> finish install the first time run by that user.
>
> Yes - users shouldn't install applications. Admins should (install Office
> as
> a custom/complete install to run everything from the local computer) - and
> for some, the user will temporarily need local admin rights the first time
> the apps are run - then the rights should be revoked.
>
>> I tried in the past restricting user rights but had various problems
>> that were solved in a stroke by allowing local admin rights.
>
> If you run into badly written apps that require admin rights, check out
> FileMon and RegMon from www.sysinternals.com
>
>> I may have a member of staff providing IT support more available in
>> the future so may try removing loacl admin rights and see how it goes.
>>
>> Think I've managed to sort it by adding the domain group top local
>> admins but I'm sure I did it differently before but maybe I'm just
>> tired.
>
> You can add Domain Users to Local Admins and it should accomplish what you
> want.
>>
>> "Lanwench [MVP - Exchange]"
>> <lanwench@heybuddy.donotsendme.unsolicitedmail.atyahoo.com> wrote in
>> message news:ueEfrW0yEHA.260@TK2MSFTNGP11.phx.gbl...
>>> Pat Horridge wrote:
>>>> Have been trying to add a brand new computer to my domain and I
>>>> can't see how to give users local admin rights.
>>>> Done this before ok but won't play ball today.
>>>> My other machines show NT Authority/authenticated users as part of
>>>> the administrator group but can't see how to add this.
>>>
>>> 1. Why is this necessary? I do not recommend it - for what purposes
>>> do they
>>> need local admin rights?
>>> 2. What errors do you get when you try to add a domain group to the
>>> local admins group?
>
>



Relevant Pages

  • RE: Impact of removing administrative rights in an enterprise running XP
    ... The most isseus are with installing applications. ... I tought that Microsoft and with them many other people almost ordered everybody to get rid of those admin rights. ... Onderwerp: RE: Impact of removing administrative rights in an enterprise running XP ... would likely require changes to the entire support model. ...
    (Focus-Microsoft)
  • Re: New computer added local user to have admin privs How?
    ... I operate a low IT support setup with all users having full local admin ... On the new machine without admin rights setup. ... Think I've managed to sort it by adding the domain group top local admins ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Making a Domain Group Local Admins Via Group Policy
    ... most people would suggest that normal user account objects are *NOT* ... I know that this is for a Support Group. ... the affected computer account objects local Administrators group and replace ... > they have local admin rights to any machines under that OU. ...
    (microsoft.public.win2000.active_directory)
  • Re: Making a Domain Group Local Admins Via Group Policy
    ... most people would suggest that normal user account objects are *NOT* ... I know that this is for a Support Group. ... the affected computer account objects local Administrators group and replace ... > they have local admin rights to any machines under that OU. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Add a domain user to Local Administrators group of an OU through GPO.
    ... You can give them the admin rights on a specific OU by ... if you want give the support the admin rights on ... the domain admins group, ...
    (microsoft.public.windows.server.active_directory)