Re: Removing everyone group from Administrator group

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Torgeir Bakken \(MVP\) (Torgeir.Bakken-spam_at_hydro.com)
Date: 12/21/04 

Date: Tue, 21 Dec 2004 13:28:04 +0100

Wayne Rollins wrote:

> On my domain I have WGMs that have placed the everyone group into
> the administrators group. Is there a way to remotely remove that
> group through say a script or is there a way to prevent them from
> doing all together by tweaking the registry?
Hi

Two options for you if this is an Active Directory domain:

A)
You could do it in a computer startup script (with a GPO) that runs
as part of the boot up process (before the user logs in). It runs
under the system context and has admin rights.

The following command in the startup script will delete the Everyone
entry in the Administrators group:

Net.exe LOCALGROUP Administrators Everyone /DELETE

B)
Restricted Groups enforced with Group Policy is maybe an option:

http://groups.google.com/groups?selm=uM5aZa1YDHA.440%40tk2msftngp13.phx.gbl

and

How to Configure a Global Group to Be a Member of the Administrators Group on
all Workstations
http://support.microsoft.com/default.aspx?scid=kb;en-us;320065

Note that the Restricted Groups policy will remove any entries in
the Administrators that is not defined in the policy. 

-- 
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: Default Security Groups
    ... I then follow your steps to apply restricted groups, ... to the computers administrator group i.e not altering any groups/users ... Domain Admins group will be added to local administrators group by ... Click the Group Policy tab, click NEW, and then name the policy. ...
    (microsoft.public.windows.server.migration)
  • Re: Default Security Groups
    ... I then follow your steps to apply restricted groups, ... computers within a domain. ... Domain Admins group will be added to local administrators group by ... Click the Group Policy tab, click NEW, and then name the policy. ...
    (microsoft.public.windows.server.migration)
  • RE: Removing local users from local administrator group
    ... Create an OU including all user accounts you want to move from local ... administrators group. ... Apply Restricted Groups group policy to this OU. ...
    (microsoft.public.win2000.group_policy)
  • Re: Domain Admin Account deleted by local Admin
    ... ou for every wise guy and enforce a group policy that contains also his ... domain account in order for him to keep his admin rights on that computer. ... >> domain admin from local administrators group. ... > Create a GPO based computer startup script that adds the "domain ...
    (microsoft.public.windows.server.active_directory)
  • Re: Use the "Managed By" field in AD to set as local Admin
    ... I think the way must be in the logon script. ... Administrators group, you can run it repeatedly until there is no message ... "Domain Admins" should be a member of the local Administrators group on ... Dim strComputerDN, strComputer, strManagerDN ...
    (microsoft.public.windows.server.active_directory)