Re: Add the loged in user to the local admin group during logon pr
- From: VS <vs@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 10 Nov 2006 22:39:50 GMT
Pluto wrote:
The problem I have is that Doamin Users ARE part of the local admin, which is BIG whole. This was something my predecessor implemented because one of the applications running on the users desktop requires local admin. The whole point is to restrict that by adding only owners of that workstation to the local admin group. Btw, users only logginto their own workstaion so there is no risk to haev soembody logging to someone else workstation.
If it's just one workstation and very limited number of known users then why not just add them manually to that workstations local administrators group.
If the same application is on several workstations, and/or the people requiring access change more than a few times a year, or if there are a large number of users - then better still is to create another Domain group with a suitable name, add the appropriate users to that group then add the group the local admins group. This way you only need to change the membership of the group when a new account is created or when someone else needs access.
I'd probably give the group a name that matches the application (i.e: ABCD App Users) and perhaps change the access permissions for the applications folder/files (on the workstation) so that only members of that group are even allowed access to the application (and even the start menu items for the application if you want to go that far).
I work for a large organisation that uses this technique to restrict access to almost every available locally installed application (as well as served applications), as that then provides some control over how many users have access and hence how many licences are required for each application.
--
VS
.
- Follow-Ups:
- References:
- Prev by Date: Re: Text File Create date problem...
- Next by Date: Re: Text File Create date problem...
- Previous by thread: Re: Add the loged in user to the local admin group during logon proces
- Next by thread: Re: Add the loged in user to the local admin group during logon pr
- Index(es):
Relevant Pages
|
