Re: Prevent Domain Users from removing workstation from domain

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Bruce Chambers (bruce_a_chambers_at_h0tmail.com)
Date: 09/22/04 

Date: Tue, 21 Sep 2004 19:47:13 -0600

Elad wrote:
> Hi,
>
> all my users are local admins
> is there a way to restrict them from removing the local computer
> from
> the domain
> i want that only the domain admin will be able to remove computers
> from the domain
>
> thanks

    Then remove the users from the local admin group. If you give
them a "license to kill," then they will. 

-- 
Bruce Chambers
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
You can have peace. Or you can have freedom. Don't ever count on 
having
both at once. - RAH

Relevant Pages

  • Prevent Domain Users from removing workstation from domain
    ... all my users are local admins ... is there a way to restrict them from removing the local computer from the ...
    (microsoft.public.win2000.general)
  • Prevent Users from removeing workstation from domain
    ... all my users are local admins ... is there a way to restrict them from removing the local computer from the ...
    (microsoft.public.win2000.security)
  • Re: Prevent Domain Users from removing workstation from domain
    ... > is there a way to restrict them from removing the local computer from ... Why are all your users local admins? ...
    (microsoft.public.win2000.general)
  • Re: TweakUI and Security
    ... Group Policy alone should not be used to restrict a user's access to a ... Make sure that NTFS permissions do not allow users to write to ... configuring them checking the application log for SRP events can help you ... on to the local computer using GP. ...
    (microsoft.public.security)
  • Re: gpo for local admin restrictions
    ... >> Is there a possibility to prevent local administrators from removing the ... >> removing themselves from the domain and I want to put a stop to this. ... >> doing this (they all must remain as local admins though). ... >> in AD but couldn't find any GPO that does this. ...
    (microsoft.public.windows.server.active_directory)