Re: Desktop Admin - HELP

From: pittspeed (turbovw18_at_hotmail.com)
Date: 06/29/04 

Date: Tue, 29 Jun 2004 13:27:32 -0400

i've made all the changes that were outlined in that website, and all the
changes that were given to me by the previous poster. I've applied the
restricted group in my GPO and refreshed my policy and all should be good...
well

i log into a fresh machine and pull down the user info... i double click on
network and microsoft network and my entire LAN is there... then i double
click on my servers and all my shares are there... then i type \\server\c$
and here is the root.

so it's not properly working... i created the group desktop admin with only
local admin rights... i have them in the admin org unit, but they are a
restricted group, so i don't know why this isn't working for me.

adversely, the 'my computer' icon is no where to be found, and i can't
enable it using XP... i also can't change the 'mode' of the start menu from
classic to XP... so i'm wondering if i goofed something up... i'm rechecking
my steps...

ALSO, i created a brand new GPO to use, and it had the same results...
please advise...

thank you.

"pittspeed" <turbovw18@hotmail.com> wrote in message
news:umrUnGVXEHA.3664@TK2MSFTNGP12.phx.gbl...
> thanks guys... i was on the right track but was caught up on the GPO
part...
>
> i'm sort of ashamed i didn't just think of this... try not to tell anyone
:p
>
> "Chriss3" <noSpamHere@chrisse.se> wrote in message
> news:%23Q6Wy5UXEHA.808@tk2msftngp13.phx.gbl...
> > This article describes what Paul means
> > http://www.chrisse.se/MAQB.asp?ID=29
> >
> > --
> > Regards
> > Christoffer Andersson
> >
> > No email replies please - reply in the newsgroup
> > ------------------------------------------------
> > http://www.chrisse.se - Active Directory Tips
> >
> > "ptwilliams" <ptw2001@hotmail.com> skrev i meddelandet
> > news:upAmzrUXEHA.4000@TK2MSFTNGP09.phx.gbl...
> > > The way to do this is make the desktop admins domain users and a
member
> of
> > a
> > > new group, i.e. desktop admins and add the desktop admins group to the
> > local
> > > admins group of local machines via the restricted groups policy.
> > >
> > >
> > > --
> > >
> > > Paul Williams
> > > _________________________________________
> > > http://www.msresource.net
> > >
> > > Join us in our new forums!
> > > http://forums.msresource.net
> > > _________________________________________
> > > "pittspeed" <turbovw18@hotmail.com> wrote in message
> > > news:%23DAXSnUXEHA.4032@TK2MSFTNGP11.phx.gbl...
> > > Hello,
> > >
> > > i would like to hear your suggestions on how to properly make a
> > desktop
> > > admin group policy that would be for a lower level admin to install
and
> > > configure the local machine, but give no network access?
> > >
> > > i was poking around and can make one up that would limit the
ability
> > to
> > > hit a network resource, but there are always tricks around that, like
> the
> > $
> > > in a unc path for instance, so i'm trying to figure out the best
> > bulletproof
> > > way.
> > >
> > > Thanks in advance for your responces.
> > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Group policy tatooing with restricted group ? or strange behaviour !
    ... Configuration 2 --> During three months, we have changed this GPO and the restricted group was defined witht the "member of" parameter so a user was able to add himself to the local admin group. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Delegating Add/Remove program authority
    ... You could use restricted group ... not a good idea to use a gpo. ... Unless you restrict this to a specific machine this group (Blah Blah) will ... be a local admin of all machines that apply this gpo ...
    (microsoft.public.win2000.active_directory)
  • Re: Where is Local Admin group in GPO?
    ... You can also use the member of function in restricted groups to add users ... which do not affect the already in place users in the local admin group. ... You can add a user to the local Admins group via a gpo using the ... From the help topic on the item: "When a restricted Group Policy is ...
    (microsoft.public.windows.group_policy)
  • Re: Local Admin Group Modification
    ... Just do not make the restricted group def in a domain-linked ... of the targetted PCs' Administrators groups. ... in a GPO that has those PCs in its ... And do this without having to overwrite the current Local Admin ...
    (microsoft.public.windows.server.active_directory)
  • Re: Local Admin on workstation
    ... except making them local admin through restricted group in GPO, they won't be able to install software. ... You may use GPO to deploy software through GPO without making them admin. ... You may also just use psexec to make a silent install remotely.. ...
    (microsoft.public.windows.server.active_directory)