Re: Want to add users to their local Admin group

From: Dmitry Korolyov [MVP] (d__k_at_removethispart.mail.ru)
Date: 04/21/04 

Date: Wed, 21 Apr 2004 15:36:59 +0400

Quote from Jason's:

"I can go around to
each PC, and manually add them to the Admin group, but that will be very
time consuming, not to mention annoying."

Above assumes adding user to Administrators group on more than one PC.
Restricted Groups with GPO are the way to do this. Maybe it's me who gets
the question wrong, but since there is a problem with performing this
operation on more than on PC, I think we should use GPO here. Otherwise we
could just manually add user to Administrators on a single given PC without
even usinc scripts and such. 

-- 
Dmitry Korolyov [d__k@removethispart.mail.ru]
MVP: Windows Server - Active Directory
  "Marin Marinov" <mlmarinov@askme.ca> wrote in message
news:MPG.1aeef78c205c34d19896c4@msnews.microsoft.com...
  In article <eO7TJxtJEHA.2692@tk2msftngp13.phx.gbl>,
  d__k@removethispart.mail.ru says...
  > You can accomplish this using Restricted Groups feature of the Group
Policy.
  > Do a KB search for "Restricted Groups"
  > Note however, that with restricted group you don't just add group to the
  > policy - you control its membership ultimately - meaning, all other
members
  > not defined in the policy will be removed.
  >
  I'll disagree with you here, Dmitry. One most likely wouldn't be able to
  implement what Jason wants with Restricted Groups. He has a specific
  user tied to one specific computer and unless there's a naming
  convention that contains the username in the computer name (or you have
  a separate GP for each PC) I can't imagine how you'd configure the
  entries in Restricted Groups. But I may be missing something and I'll be
  glad if you prove me wrong ;)
  -- 
  Cheers,
     Marin Marinov
     MCT,MCSE 2003,MCSE:Security 2003
  -
  This posting is provided "AS IS" with no warranties, and confers no
  rights.

Relevant Pages

  • Re: Power User Setting Not Saved
    ... I've added the local user to the Power Users ... However Group Policy Restricted Groups ... can be used to manage membership of the power users group which seems to be ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Want to add users to their local Admin group
    ... You can accomplish this using Restricted Groups feature of the Group Policy. ... policy - you control its membership ultimately - meaning, ... while Domain wide being part of the Domain Users. ...
    (microsoft.public.windows.server.active_directory)
  • Re: remove local admin rights
    ... I have set up a policy to make all domain users Local Admins - I ... users have remained in the local Admin group... ... Double-click Startup, click Add ... Restricted groups are useful sometimes but I'm old fashioned and prefer the ...
    (microsoft.public.windows.group_policy)
  • Re: How do I get Restricted Groups to be real time?
    ... It is the Computer policy refresh that applies the Restricted group defs. ... LAN local DCs situation). ... > group as I have configured with Restricted Groups. ...
    (microsoft.public.win2000.security)
  • Re: problem with "Restricted Groups" within a GPO linked to my dom
    ... Though I did check the inheritance on the Domain Controllers OU and the ... Default Domain Controllers Policy ... ......I had initially set up the Restricted Groups within the Default Domain ... >> same group membership as is shown in ADUC. ...
    (microsoft.public.security)
Loading