Win2003 Active Directory - Roaming Local Administrator Account?

_Kaiser_ · 11-09-2007 1:16pm #1

Is there a way to setup a group of users that will automatically have local admin rights to a PC, without me having to first login as an Administrator on that PC to grant them this access?

I know a Domain Administrator account will automatically have these rights, but obviously I don't give THAT level of access to users - JUST to their local PC.

Hope that makes sense... cheers in advance!

seamus · 11-09-2007 1:34pm

No, there's nothing inbuilt.

When you add a machine to the domain, the only group added to the local administrators group, is the domain admins.

The good news is that this can be scripted or executed remotely so you don't necessarily have to log onto the machine first. It does need to be done individually on each machine though, so it's best to create an image with this group in it if you're looking to do it for multiple machines.

A long-winded way would be to create the group, add them to the Domain Admins, then go about setting explicit Deny permissions for that group for everything on the domain. You will miss something though, it will take forever and it horrifically violates the principle of least permissions.

Edit: I may be slightly wrong. Group Policy could do it easily for ye
http://support.microsoft.com/kb/810076

Win2003 Active Directory - Roaming Local Administrator Account?

Comments