Re: Administrators Group in Local Users and Groups

There is absolutely nothing that has to be done on the client side.

Create the gpo in the ou where the Computers reside (NOT the users), go to
computer configuration/windows settings/security settings/restricted groups,
right click on restricted groups and select new group (For the local
computers, this group name should be - administrators) and key in the group
you want auto populated. Select add on the Members of this group and then
add the members you want populated.



--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.


"Mark Morrell" <morrellm@xxxxxxxx> wrote in message
news:OTnMwFIDGHA.1676@xxxxxxxxxxxxxxxxxxxxxxx
> Ok, this is good. I set up the gpo for the domain admins and my new
> helpdesk group.
> It works great for adding or deleting users from those groups.
>
> But I still have no idea how to propagate that info down to the
> workstation.
> I assume I need to make these new restricted groups a member of the local
> administrators group, but it won't let me browse outside the active
> directory and putting in administrators just goes to the domain one.
> The first link you sent starts talking about adding them to the local
> security accounts, but doesn't say how. It just shows another domain
> group
> added in.
>
> I know I'm probably missing something simple, but isn't that always the
> way?
>
> Please help
>
> Thanks
> Mark
>
> "Paul Bergson" <pbergson@xxxxxxxxxx> wrote in message
> news:%23wKk76$CGHA.2040@xxxxxxxxxxxxxxxxxxxxxxx
>> You could use the restricted user group gpo setting
>> http://www.windowsecurity.com/articles/Using-Restricted-Groups.html
>>
>>
> http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/156780ef-eb36-4433-b3fe-1b1a15c18f6a.mspx
>>
>>
> http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_scerestrictgroups.mspx
>>
>>
>>
>> --
>>
>>
>> Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA
>>
>> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>>
>>
>> "Mark Morrell" <morrellm@xxxxxxxx> wrote in message
>> news:O204Pp%23CGHA.3684@xxxxxxxxxxxxxxxxxxxxxxx
>> > Hi!
>> > I am trying to find out how to add in the domain group Account
>> > Operators
>> > to
>> > each workstations administrator group (without going to each computer).
>> >
>> > Domain Admins is added into each computer when it joins the domain.
>> > I want Account Operators to do the same.
>> >
>> > Running Server 2000 and 2003 native
>> > With Workstations 2000 and XP
>> > All updates as of yesterday.
>> >
>> > Thanks
>> > Mark
>> >
>> >
>>
>>
>
>


.

Relevant Pages

  • Re: Strategy for Join Workstations to the Domain
    ... On the OU chosse the delegate control wizard. ... I intend to create an account only to join the workstations to the ... My question is If I go to GPO I must create an account and modify the ...
    (microsoft.public.windows.server.active_directory)
  • Re: How to deny log on locally
    ... he/she logs on local to such and such a machine with a local user account). ... You have four departments in your environment: Finance, Accounting, ... Workstations, one called Accounting Workstations, one called MKTG/Sales ... Go to the Finance Workstations OU and create a GPO. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Strategy for Join Workstations to the Domain
    ... Best Regards. ... I intend to create an account only to join the workstations to the ... My question is If I go to GPO I must create an account and modify the ...
    (microsoft.public.windows.server.active_directory)
  • Re: Forcing groups into the local admin account
    ... Does this remove the local Administrative account for the ... machine as being part of the local Administrators group? ... >of the GPO that you use. ...
    (microsoft.public.windows.group_policy)
  • RE: Strategy for Join Workstations to the Domain
    ... But there is still some way to join computers on the domain. ... I intend to create an account only to join the workstations to the domain ... My question is If I go to GPO I must create an account and modify the Domain ...
    (microsoft.public.windows.server.active_directory)