Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have scanned our domain and there are just a couple of PC's where an user is localadmin (this was enabled in the past for a certain application/installation). We need to disable this now. Is there a way to do this remotely?

OS: windows XP clients in network / domain environment

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Open Active Directory Users and Computers, select the computers in question, right click, select manage, and remote their domain accounts from the Administrators group. Close, and have the users log out and log back in.

Problem solved.

share|improve this answer
    
thank you, this solution worked for us (actually I did think about this before, but I thought it would not work and I did not test it ) :) thanks ! –  ICTdesk.net Jun 11 '10 at 14:20
    
ADUC is a fantastic tool that allows you to do SO MUCH more than just resetting passwords. I once had a boss that didn't know about the Manage function built into ADUC, and was BLOWN AWAY by the fact that I had device manager open on a remote machine through ADUC. And you're very welcome. –  phuzion Jun 11 '10 at 16:09
add comment

I think what you are looking for is the use of restricted groups through group policies. I found this article which explains the use of restricted groups in detail: http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

Hope this helps.

share|improve this answer
add comment

you could try psexec \\machinename net localgroup "administrators" "domain\user" /delete

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.