Re: Need to remove powerusers ability to create a share on the local c

It is pretty much impossible to prevent admins and anyone who can become admins if they know what they are doing (power users) from doing anything on a given local box.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm



Rasman wrote:
Looking for a method to remove the local machine poweruser and administrator ability to create a share.
.

Relevant Pages

  • Re: Desktop Admin
    ... Enter Power Users ... Desktop Admins to the 'Members of this group' section. ... i'm confused on your sentence "and add the desktop admins group to the local admins group of the local machines via the restricted groups policy" so how do you envoke local rights on a workstation through AD? ...
    (microsoft.public.win2000.active_directory)
  • Re: Setting unchangeable IPs
    ... If users are admins, they already have the ability to change their IP info. ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • What is the best way to allow users run legacy apps?
    ... 'legacy applicatons'. ... Only admins and power users only seem to be able ... ie. some apps fail to ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Power Users
    ... I can't see Power Users under resricted groups either.... ... Thats how/why I ... put them in local Admins... ... >> I have a bunch of users who are currently Admins, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Delegation of Auth and the Computers Container
    ... Define full-on god rights to an OU. ... Joe Richards Microsoft MVP Windows Server Directory Services ... > admins have full-on god rights to an OU. ... > Computers container by default, ...
    (microsoft.public.windows.server.active_directory)