Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to give a domain user full control of their local drives at the Group Policy end?

Specifically, my IT Manager wants the following:

a) Desktop control allowed
b) Full access to local hard drives
c) Software Installation NOT Allowed
d) Existing software Updates Allowed
e) Install additional printers

Allowed At the moment, our Win2003 setup does not allow users to do a,b,d,e - I wondered if there was a way using GP to enable these?

share|improve this question
    
If you provide additional details of what you want to accomplish, you may get answers that don't involve opening everything up to end users. –  jscott Mar 11 '10 at 14:06
    
Specifically, my IT Manager wants the following: a) Desktop control allowed b) Full access to local hard drives c) Software Installation NOT Allowed d) Existing software Updates Allowed e) Install additional printers Allowed At the moment, our Win2003 setup does not allow users to do a,b,d,e - I wondered if there was a way using GP to enable these? –  spelk Mar 11 '10 at 15:38
    
You should add your comment to your question above for clarity. A,C,D,E can be accomplished without making Domain Users members of local Administrators. For what purpose does your manager think "Full" access to the local hard drives is required? Does this mean users can delete the contents of %WINDIR%? If the users only need to be able to browse local disks, this is not an issue. –  jscott Mar 11 '10 at 15:51
    
We're migrating from a setup where all users (<100) where logged in as Administrators on their XP machines, so I think the idea is to ease their transition by not restricting where they can save their files. Many of them would have data files off the root of C: etc. I'd like to make their machines as secure/safe as possible, but we also don't want to "demonise" the new network setup by lots of restrictions. All advice is gratefully received. –  spelk Mar 11 '10 at 16:25

3 Answers 3

Yes, although it's a registry based change so you have to configure an .ADM file. Full details at Microsoft Here. (You obviously want the 'Do not restrict drives' option)

share|improve this answer

I would observe that what you're trying to do is a really bad idea.

Having said that, you can use the File System security policy to grant access to files / folders using Group Policy.

You have conflicting requirements (and wholly orthagonal requirements to your question, too). If you're taking away "Administator" rights but giving users "Full Control" of the disk the OS is installed onto then you're just giving them an ability to get "Administrator" rights back (as well as installing software, malicious software, etc) by modifying OS files.

If you're trying to get users to stop being "Administrators" and start cleaning up your support procedures your best bet is to look at using "Folder Redirection" and mounting a political campaign of convincing users that their data will be safer, more secure, and more accessible by storing it in their "My Documents" folder (which you'll then redirect to a server computer).

There's no good reason to be saving files on a local hard disk drive. Any reason you can think of isn't good enough. Microsoft has done a great job, in the last few server / client OS releases, of providing mechanisms to store data server-side, have it available client-side even when disconneced from the network, and all the while keeping the data safe and secure.

It takes hard work, time, and effort to transition away from a culture of "everyone's an Administrator". You'll have to use tools like "Process Monitor" to beat your software into submission re: running as non-privileged users. If you can get it done, though, you will be a much better world re: recurring support cost, fighting "fires", etc.

share|improve this answer

by default only domain admins group is added as local admins on a pc. But you can on the computer go to the "computer management" (right click on computer and click manage) and in groups - administrators go and add domain users aswell. Thats the way i do it. its a long process if you need to do it on alot of computers.

So if anyone got a better solution i wouldnt mind either.

share|improve this answer
    
The better solution is to use Group Policy Restricted Groups to populate the local groups automagically: support.microsoft.com/kb/320045 However adding "Domain Users" to the local Administrators group is, um, brave/stupid (your choice). –  jscott Mar 11 '10 at 13:46
    
@Morten: He was looking for a way to do this via GPO. –  DanBig Mar 11 '10 at 13:49
    
I agree that it probably isnt a good idea. If they arent already running as local admins I would keep it that way. We tried it and had major issues with clever malware that depends on the users lack of knowledge to get permission to run. –  cop1152 Mar 11 '10 at 13:58
    
I've looked into the use of Restricted Groups, and I'm a bit flummoxed to be honest. How do I include the local Administrators group (all I can see are the domain accounts). Do I just enter 'Administrators' after I right click and select Add Group? Then I add the security group that contains our users to the 'Members of the group' list? –  spelk Mar 12 '10 at 16:51
    
@Ian. Select 'Add Group' and enter the exact local group name (don't click 'browse') you wish to populate and click 'OK'. Also, please consider other options besides adding 'Domain Users' to the local Administrators group, please. –  jscott Mar 12 '10 at 18:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.