Re: Want to add users to their local Admin group

From: Dmitry Korolyov [MVP] (d__k_at_removethispart.mail.ru)
Date: 04/20/04 

Date: Tue, 20 Apr 2004 17:34:57 +0400

You can accomplish this using Restricted Groups feature of the Group Policy.
Do a KB search for "Restricted Groups"
Note however, that with restricted group you don't just add group to the
policy - you control its membership ultimately - meaning, all other members
not defined in the policy will be removed. 

-- 
Dmitry Korolyov [d__k@removethispart.mail.ru]
MVP: Windows Server - Active Directory
  "Jason Ash" <m0ng0lh0rde@netscape.net> wrote in message
news:Xns94D11144656Cjash7165wideopenwest@216.196.97.132...
  Hi,
    Here is what I am trying to acomplish, I would like to add a user to
  the local Administrators group of a PC.  However, I would like to only do
  this on the PC that the user will normally be working from, and if any
  other user logs in on that PC, I would like them to only be a part of the
  Domain.
    In the office I work, everyone has a PC they typically work from.  I
  would like them to be a member of their local PCs Administrators group,
  while Domain wide being part of the Domain Users.  I can go around to
  each PC, and manually add them to the Admin group, but that will be very
  time consuming, not to mention annoying.
    I have not found anything in the GPO that seems to allow me to do this.
  If I cannot find an easy way of doing this, than we may just leave
  everyone as part of the Domain Users, and if they complain about not
  being able to load something, and can justify the need, add them to their
  local Admin group.
  Any better ideas are welcome.
  Thank you,
  Jason A.
  -- 
  -------------------------------------
  Reply to for SPAM only
  All others use:
  m0ng0lh0rde @ ukonline . co . uk
  Remove spaces to send
  Thank you
  -------------------------------------

Relevant Pages

  • Re: Power User Setting Not Saved
    ... I've added the local user to the Power Users ... However Group Policy Restricted Groups ... can be used to manage membership of the power users group which seems to be ...
    (microsoft.public.windowsxp.security_admin)
  • Re: problem with "Restricted Groups" within a GPO linked to my dom
    ... Though I did check the inheritance on the Domain Controllers OU and the ... Default Domain Controllers Policy ... ......I had initially set up the Restricted Groups within the Default Domain ... >> same group membership as is shown in ADUC. ...
    (microsoft.public.security)
  • Re: Want to add users to their local Admin group
    ... > You can accomplish this using Restricted Groups feature of the Group Policy. ... > Do a KB search for "Restricted Groups"> Note however, that with restricted group you don't just add group to the> policy - you control its membership ultimately - meaning, all other members> not defined in the policy will be removed. ... Marin Marinov MCT,MCSE 2003,MCSE:Security 2003 - This posting is provided "AS IS" with no warranties, and confers no rights. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain Users have no share tab
    ... There is no policy for such as that is strictly dictated by group ... membership. ... There is a user right that allows users to share permanent ... I know that I can add the Domain users to ...
    (microsoft.public.win2000.group_policy)
  • Re: Software Restrictions
    ... When I denied Project Users Read & Apply Policy, ... user could not access any of the restricted applications to include Project. ... >>I want to implement 2 GPOs to restrict certain software. ... >> be applied to the Domain Users security group. ...
    (microsoft.public.windows.server.active_directory)