Re: Local Admin user removed from Administrator group

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

In news:45AE3C51.2080907@xxxxxxxxxxxxxxxxxxxxxxx,
Adrian Marsh (NNTP) <adrian.marsh@xxxxxxxxxxxxxxxxxxxxxxx> typed:
Hi,

I've a fairly out-of-box SBS 2003 R1 group policy setup.

I've added a new SQL server, which runs some Jboss applications. As
part
of the Jboss setup I need to run a service as a local Admin.

I created the local user (I don't need/want a domain account for
this),

Why not?

and assigned them to the local server Administrators group.

I have a GPO that says all domain users are part of their local Admin
group.

That's unwise; your users should not be anything other than users. However,
that being said, are you using restricted groups? If so, this is normal -
the restricted group settings supersede the locally-configured group
membership. Perhaps you need to link the GPO in question to another OU or
otherwise exclude it from being applied to the member server in question.

This seems to have the effect of removing my Local users from the
Local Administrators group. (We see an event 637 when I turn on more
logging).


How can I enable either the Domain, or Local GPO to let the Jboss user
keep its Administrator rights?

Cheers,

Adrian



.

Relevant Pages