I am going through the process of removing all my users from local admins from their machines. I put each user as local admin when the box was imaged so I could avoid all the trouble. Well, now after a surge of users getting virus/malware I decided it's time to deal with the lesser of two evils.
I know that the best way of doing this will be through the restricted groups GPO. I attempted this last week while most of my users were gone and I had a pretty crappy morning and I reverted all the changes.
What I did was for the group, I specified Administrator (Does this automatically assume local groups? If when I browse and say local computer (being the dc) does that mean every computers local group?) and then I chose the (domain group) domain admins and put them in the "Members of this group:"
Correct me if I am wrong here... but when I did this, all user accounts (not profiles) were "deleted" from the computer. I am assuming this happened because since these users had been set to only local admins, when i set this policy it removed them from local admins and their account was deleted from the computer. Some of these users lost the "link" to their local profiles and I had to move all their stuff and set everything back up. I also had a lot of permission issues throughout the company such as RDC issues and read/write issues.
Sooooo! I am thinking about re-doing this a little bit the other way around and I want some input. This time, I am going to put the initial group as power users (local) and then set all my users as "members of this group:"
Do you guys see any repercussions to doing this? Is this the correct way to solve my problem?
Thanks a lot!