Re: System admin

From: Tomasz Onyszko (T.Onyszko_nospam__at_w2k.pl)
Date: 07/21/04 

Date: Wed, 21 Jul 2004 23:06:27 +0200

Craig wrote:

> Is there a way to limit the administrative rights to a
> user who we would want to assign admin rights to? We have
> a tech, who we only want to allow him to install software
> on pc's and NOT do anything administrative to our
> network. Is there away to do this through delegation,
> group policies, instead of having to make him a local
> admin on each pc?
>
> Help is greatly appreciated.

This was discussed today on this list - You can acomplish this by
forcing administrators group membership via Restricted Group settings in
GPO. This option lets You specify who will be a member of specified
group (for example administrators) and then force this setting on all
system which are under the scope of this GPO 

-- 
Tomasz Onyszko [MVP]
T.Onyszko@w2k.pl
http://www.w2k.pl

Relevant Pages

  • Re: Security
    ... "George Hester" said ... The user did have admin rights that was signed on at the ... The GPO was not 'violated'. ... Use ACL's on the registry key. ...
    (microsoft.public.win2000.group_policy)
  • Re: Global Security Group on XP Machine
    ... For the local machine login, given that you must have this, ... you could place INTERACTIVE as a member of Administrators ... All of the 500 users have, and require, admin rights on the PC that they ... There is a global Security group, in active directory, that is a member ...
    (microsoft.public.security)
  • Re: Locking down Mac OSX clients
    ... > Why are you giving them admin rights if you want to restrict their ... administrators because they product that they support must be installed ... Not to mention there are certain things (i.e. network prefs) that I ... preferences as the user then remove the preference panes. ...
    (comp.sys.mac.system)
  • Re: Best way to give local admin rights only across the domain
    ... restricted groups feature in a GPO --> allows you to add a group/user to local groups on clients/servers if those fall under the scope of management of the GPO with that configuration ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ... afraid that will give them admin rights on the domain. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Changing IP address as standard user
    ... The first thing that comes to mind is some sort of .REG file or GPO. ... > to change their IP address without giving them Admin rights? ...
    (Security-Basics)