Local Admins on Machines

Hi,

A lot of our users are set as local admin on their own machine. This is not
something i personally like and something we want to stop.

But then we get problems that we just can't get round so end up making them
local admin. For example a use some features in access 97 and also can't use
some other SQL related tools.

(I realise this is not an AD question as such) but i will link to it.


Is there a better way?

Also is there anyway with a Group Policy to allow them full access to a
specific program or anything.


I realise i may be clutching at straws here but so many people request admin
privs and we just end up giving them because we can't find workarounds.


Any info/help/suggestions on what your business currently does greatfully
appreciated.

Michael.



.

Relevant Pages

  • Re: Exempting a Computer from Application of Group Policy?!
    ... with local admin credentials creates a local admin account for themselves, ... they logon with that account they will not have user configuration applied to them. ... Computer configuration for Group Policy will apply regardless of if domain or local ...
    (microsoft.public.win2000.security)
  • Re: Manage Workstation Rites
    ... Atom Ant typed: ... I would like to keep users with local admin rites but limit their ... Can anyone suggest a Group Policy scheme to accomplish my goals? ...
    (microsoft.public.windows.server.active_directory)
  • Wallpaper and desktop policy
    ... Do you currently have a group policy? ... User Config> Admin Templates> Desktop. ... As for the local admin, go to control panel and under ...
    (microsoft.public.win2000.group_policy)
  • Re: local computer admins
    ... The short answer is that you don't do this with group policy. ... You could use a startup script that is sensitive to which machine ... > administrators group on users pcs. ... The problem here is that everyone in that group gets local admin to ...
    (microsoft.public.windows.group_policy)
  • Re: local computer admins
    ... The short answer is that you don't do this with group policy. ... You could use a startup script that is sensitive to which machine ... > administrators group on users pcs. ... The problem here is that everyone in that group gets local admin to ...
    (microsoft.public.win2000.active_directory)