This posting is provided "AS IS" with no warranties, and confers no rights.
<jessehardy@xxxxxxxxx> wrote in message
news:1129734290.814427.255380@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx >I am trying to implement a policy which makes all domain users, power
> users on their local machines. However some users ie:Laptop Users are
> defined locally as an administrator of their machine only. How can I
> maintain these users as local admins on their machines only, while
> making them power users on other computers on the network.
>
> Basically I want all domain users to be power users, unless they are
> listed as a local admin on a computer, In which case they would be an
> administrator.
>
Re: local admin issues ... The built-in local groups (e.g. Administrators, Power Users) are present and have the same SID on all Windows computers. ... Is there a way to prevent domain admins to be removed from the local admins... browse to the ldomain's Local Admin Users Group and add it to the local XP machine's groups and choose Administrators... (microsoft.public.windows.server.active_directory)
Re: Installing Software without being Local Admin? ... Some of you may remember back in June I posted a topic entitled 'Network Computer Games on Business Machines' which detailed the problem we were having with some of our users installing software & games on their machines, as they were local admins. ... So I need to find someway of allowing users to install fix packs/re-install the software, without giving them full local admin access. ... (microsoft.public.security)
Re: foreign language gpo ... (most machines are win2k, Policy editing machine is Win XP with GPMC). ... Your problem with the Power Users Group is a little bit more difficult. ... The problem is, that your edit the GPO from a system, that did not write ... You need the SID of the group inside your GPO, ... (microsoft.public.windows.group_policy)
Re: In reality, are your users "non administrators" on their desktops ? ... > Currently my users are happy as 'administrators' on the local machines, but> since we've deployed SMS and patches and service packs can now be installed> under SMS account I am> considering downgrade the users rights on laptops from "administrator" to> "power users". ... All users on my network are only users - Not local admins or power users.... Admiitedly my network is a lot smaller than yours at only 500 users, but IMHO the larger the organisation the tighter controls you need over what the users can do. ... (microsoft.public.win2000.active_directory)
Re: Global Account for Installing Software ... You could create a sub-ou within the main ou for these machines and use ...restricted groups to delegate a subadmin to manage these machines. ... If you want them to be local admins so they can perform maintenance than you ... (microsoft.public.windows.server.active_directory)
