Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have scanned our domain and there are just a couple of PC's where an user is localadmin (this was enabled in the past for a certain application/installation). We need to disable this now. Is there a way to do this remotely?

OS: windows XP clients in network / domain environment

share|improve this question
up vote 3 down vote accepted

Open Active Directory Users and Computers, select the computers in question, right click, select manage, and remove their domain accounts from the Administrators group. Close, and have the users log out and log back in again.

Problem solved.

share|improve this answer
thank you, this solution worked for us (actually I did think about this before, but I thought it would not work and I did not test it ) :) thanks ! – Jun 11 '10 at 14:20
ADUC is a fantastic tool that allows you to do SO MUCH more than just resetting passwords. I once had a boss that didn't know about the Manage function built into ADUC, and was BLOWN AWAY by the fact that I had device manager open on a remote machine through ADUC. And you're very welcome. – phuzion Jun 11 '10 at 16:09

I think what you are looking for is the use of restricted groups through group policies. I found this article which explains the use of restricted groups in detail:

Hope this helps.

share|improve this answer

you could try psexec \\machinename net localgroup "administrators" "domain\user" /delete

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.