Re: Granting client local admin access via GPO to logged on user o

Of course if you have the time to test, Meinolf's answer would be best.

"Meinolf Weber" wrote:

Hello jmedd,

A remark to the reason, we use round 150 different applications (commercial
and not commercial) on windows 2000 and no user needs administrator rights
to run them. With filemon and regmon you can find the file's and geristry
key's where they need more rights. Better change them via GPO or with login
scripts, so that they are still normal users.

How often have they to install printers? Is it really needed to be admin
always or is it possible for you to make the install for them?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.dts-l.org/goodpost.htm

Thanks for the reply.

The difference is that they only need to be admin on the machine they
use to do things like run certain applications which need admin
rights, install printers etc.

The downside with the way we currently have this setup is that anyone
with half a brain can consequently get access to the local drives on
any other client machine. Although users are advised not to store data
on their local machines there's a long standing culture here where
they still do so there's a potential security concern of being able to
access someone else's data.

So I only want them to have local admin rights on the machine they
use. There's very little (if any at all) concept of people sharing
machines, i.e. a machine issued to one person is typically only used
by that person.

Hopefully that makes sense.

"Danny Sanders" wrote:

Obviously this means that anybody has admin access to any machine.

What I would like to be able to achieve is the logged on user should
only have admin access to the machine they are currently using.

I'm not seeing the difference. When a user logs into a computer they
are made administrator of that machine. If they log into another
machine you want them to be admin there also.

What is the problem with them having admin access to "any machine",
when you allow them to log onto "any machine" and give them admin
access on "any machine" they are using?

If they *need* admin access to do their job on one machine, and they
access
that machine remotely, they are going to need admin access to the
remote
machine to do their job.
If they can do their job remotely and they don't need admin access to
do
their job remotely, they probably don't need admin access to do their
job
when logging in locally to that same machine.
DDS

"jmedd" <jmedd@xxxxxxxxxxxxxxxx> wrote in message
news:1BDB007C-E564-4DCE-BDA6-2B08FC04A1E4@xxxxxxxxxxxxxxxx

We need to give our users local admin access to their client 2000 /
XP
machines and currently this is done via a GPO which adds a
'LocalAdmin
Access' domain based group to the local administrators group. Users
are
then
added to the domain based group.
Obviously this means that anybody has admin access to any machine.

What I would like to be able to achieve is the logged on user should
only have admin access to the machine they are currently using.

Does anyone have a suggestions how this could be done via GPO?

Thanks




.

Relevant Pages

  • Re: Granting client local admin access via GPO to logged on user o
    ... we use round 150 different applications on windows 2000 and no user needs administrator rights to run them. ... What is the problem with them having admin access to "any machine", ...
    (microsoft.public.windows.server.active_directory)
  • Re: error when trying to get a remote security policy... Please help!!!
    ... I have full admin rights on the directories. ... Is this a domain machine? ... >> to get the security policy from, infact I have network admin access. ...
    (microsoft.public.win2000.security)
  • Re: Admin Rights required on Terminal Services
    ... ('binary' encoding is not supported, ... >rights to everyone, one thing you could do is start ... Somthing similar was proposed in a previous post, will try to do this ... >Why not give admin access to users and use group policy to remove any ...
    (Security-Basics)
  • Re: vb.net and Vista-daily use
    ... You can set it to always open with admin access. ... I'm assuming you have installed both VS2005/SP-1 and the SP-1 Vista Patch ... an account with local admin rights, or should I use ordinary user rights ... and enable one the Visual Studio app to run with administrator rights? ...
    (microsoft.public.dotnet.languages.vb)