Re: How to make regular user a default admin for Computers underhisOU ?

Thanks Mr. Weber,

I redid the OU and groups from scratch and applied the "restriced groups" policy. It works now.

I found out too that besides the default permissions given to this group on the delegation of the OU, I still had to give Create/Delete "all child objects" permission on this OU to that group so that they could manually create a computer entry in the ADUC window (right click, New->Computer). And once they create and join their computers, they can do all the admin tasks fine.

Thanks for the help.

David



Meinolf Weber wrote:
Hello DavidC,

Seems that some more policies are set for the used group. For changing the workstation name, for example, you must have domain admin rights or the group has to get delegated the right to change a workstation name, because it is a domain member. Ofcourse you can change from domain to workgroup and rename then the workstation, but then you have to rejoin to the domain, which is not aible for local admins by default.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

Well, I thought this was all I needed to do so that this regular user
group could have admin permissions on their machines. But I'm still
missing something because the system still doesn't let that group do
Admin tasks (change name of machine, enable/disable remote desktop,
etc, login remotely, etc).

In the group policy on the system (on the client: open mmc, add Group
Pol snap in and look at members of the Administrator group) I can see
this group being a member of the Administrators group. But yet, when I
login as one of them I cannot do any Admin related tasks.

What else do I need to do besides adding this group to the "Restricted
Groups" in the policy for this Org. Unit ? I need all their computers
to allow this group default Admin access.

David

DavidC wrote:

Mr. Weber,

Thanks a lot. That site explains it so clearly. It was very helpful.

Thanks!

David

Meinolf Weber wrote:

Hello DavidC,

Use the Restricted Groups with GPO.
http://www.frickelsoft.net/blog/?p=13
Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Hello,

On Win2003 Server I created an Organizational Unit TEAMOU and I
delegated control of it to the TEAMOU_Admins group. Under that OU I
added a Computers OU for them to add their computers. That all
works fine, but I also want them to be the default Admins of those
computers in that TEAMOU\Computers folder so that they can login
remotely and locally. I don't want to add this group to my default
Domain_Admins group. How else can I give them this ability ?

I've tried putting a GroupPolicy on TEAMOU to set the groups
allowed to login locally, through the network and through terminal
services (Administrators, Remote Deskop Users,
Mydomain\TEAMOU_Admins). But as soon as they try to login through
terminal services to their machines, they get an error about the
local policy not allowing them to login interactively.

Any hints?

Thanks

David



.

Relevant Pages

  • Setting directory permissions
    ... For a login log file on the local machine to track some login problem I need ... I have a Domain test policy assigned to an OU with a few users and computers ... So on this machine the rights are as they are supposed to be and the policy ... Do I need to give the computers read rights to the policy or does the SYSTEM ...
    (microsoft.public.win2000.active_directory)
  • Re: Server 2003 Local Login
    ... I have looked at the local policy and as you mentioned administrators are ... How do I login as the local admin and not a domain ... admin or user authenticated to AD users and computers? ...
    (microsoft.public.windows.server.active_directory)
  • Re: no public access
    ... Do the non-admin users have the Log on Locally user right assigned to them? ... > policy settings, the first policy is allow the server to ... >>error if you don't login. ... If you login with admin account ...
    (microsoft.public.inetserver.iis.security)
  • GPO troubles
    ... For some reason, 1 hour into the work day and most ... point to a group policy issue. ... these computers will NOT log on. ... locally, the computer accepts the login, then promptly logs you off. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Administrator Profile corruption
    ... in a new profile being created at each logon. ... policy hasn't been incorrectly adjusted then fault is the ... This would distinguish 'is it the admin profile?' ... However maybe this is a clue: When I RDP into server login, ...
    (microsoft.public.windows.server.sbs)
Loading