Re: Local Admin & Group Policy Question

On 24 Jan 2006 06:25:59 -0800, email4matt@xxxxxxxxx wrote:

>I wanted to make Domain Admins a local administrator of all machines
>through Group Policy (I think this happens by default when a machine is
>added to the domain, but some users remove it). I found that it can be
>done with "Restricted Groups". The policy seems to work ... but ... it
>appears to overwrite what's already in the local administrators group.
>For us, this is a problem. On some servers or PCs, we have added
>individuals to this group, and they need to remain there. Is there any
>way to have the Group Policy ADD to the local administrators group, as
>opposed to replacing what's there? Thank you!

NOT with Group Policy Restricted Groups.

You could use a Startup script on each workstation:

@echo off
net localgroup Administrators "NetBIOSDomainName\Domain Admins" /ADD

But since your users are local admins (how else could they remove Domain Admins?)
they can remove it eacxh time.

You can also use the Task Scheduler and script a batch on each computer, all from your desktop,
or,
or,
or,
....



Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com
.

Relevant Pages

  • Re: Script to enumerating list of Local Admingroup member of all domai
    ... Administrator as members of machine local Administrators ... group on all machines, just define this as a Restricted Group ... domain admins and local administartor account from the computer. ...
    (microsoft.public.windows.server.scripting)
  • Local Admin & Group Policy Question
    ... I wanted to make Domain Admins a local administrator of all machines ... through Group Policy (I think this happens by default when a machine is ... appears to overwrite what's already in the local administrators group. ...
    (microsoft.public.win2000.group_policy)
  • Re: add domain admin group to local pc admin group using AD
    ... Domain Admins are local administrators by default. ... Restricted Groups under Security Setting within a Group Policy to setup a ...
    (microsoft.public.win2000.active_directory)
  • Re: Prevent local administrators installing software
    ... It is difficult if users are local administrators. ... Group Policy user configuration/administrative templates/system to take ... Applications after reading the whole description of what the settings do. ... > free software from the web and installing it all over the place. ...
    (microsoft.public.win2000.networking)
  • Do Not Execute Group Policy for Admins Group
    ... so that the group policy will only apply to a certain group of users ... domain admins that logon to a computer in that OU). ... In this case the GPO would not ... it's intent is to change the user settings ...
    (microsoft.public.win2000.group_policy)