Change local admin settings

Hi All,

I've a scripting dilemma for you. When we first setup our SBS 2003
server, I was asked to make it simple (working only 1 hour a week..,
remotely)

At the time, the simplest setup was to make each user a local admin, so
they could install apps etc.

I did this by adding the Domain Users group to the Restricted Groups
"Administrators" group. This gave easiest setup, as users could share
and cross use PCs as need be.

However, I now need to break this up. Our company has grown. I have a
bunch of "corporate PCs" (around 60), and a bunch of "Lab PCs".

I'd like to change the Corporate PCs, so that each user is still an
Admin of their local PC, but does not necessarily have access to other
peoples PCs. The lab PCs are shared via a single user account anyway.

Heres my dilemma:

If I just remove the Domain Users from the Restricted Group, then
obviously end users just loose admin access. But I need to maintain
each user has access to their own PC.

I was thinking of adding a logon script, that ran as a domain admin
account (runas or something), that then added that user to the local PCs
admin group, something based around this document:

http://www.microsoft.com/technet/scriptcenter/resources/qanda/oct04/hey1008.mspx

This way, even though the domain policy has been freed the Restricted
Group, the logon script would hopefully add them back in before they'd
notice.

Can anyone suggest a better idea?

Cheers,

Adrian
.

Relevant Pages

  • Re: ActiveX create problem in Vista
    ... have to create the script once. ... registering during setup. ... Vista with those components, ... an OS that doesn't let admin be ...
    (microsoft.public.vb.general.discussion)
  • questions on map printers based on groups
    ... The script will run within their logon script. ... The users DO NOT have admin priviledges on the pcs. ... printers that are different make and models. ...
    (microsoft.public.scripting.vbscript)
  • Re: Change Local Administrator passwords remotely
    ... woudnt that scirpt also need to run with admin privs.... ... >> I am trying to change the local administrator account ... >> another for all PCs in your organization. ... > Script to run at logon: ...
    (microsoft.public.win2000.security)
  • RE: Not working with WinXP?
    ... Wherever an Admin may be when they decide to run it. ... All the PCs on which it failed are running XP with all the ... How can I mod the script, ... >> Dim strDateStamp ...
    (microsoft.public.scripting.vbscript)
  • Re: WMI Authentication
    ... They don't need to be admin on the machine to get info from WMI. ... Use of included script samples are subject to the terms specified at ... > they do not necessarily have administrator rights on the PCs the script ...
    (microsoft.public.win32.programmer.wmi)