Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am going through the process of removing all my users from local admins from their machines. I put each user as local admin when the box was imaged so I could avoid all the trouble. Well, now after a surge of users getting virus/malware I decided it's time to deal with the lesser of two evils.

I know that the best way of doing this will be through the restricted groups GPO. I attempted this last week while most of my users were gone and I had a pretty crappy morning and I reverted all the changes.

What I did was for the group, I specified Administrator (Does this automatically assume local groups? If when I browse and say local computer (being the dc) does that mean every computers local group?) and then I chose the (domain group) domain admins and put them in the "Members of this group:"

Correct me if I am wrong here... but when I did this, all user accounts (not profiles) were "deleted" from the computer. I am assuming this happened because since these users had been set to only local admins, when i set this policy it removed them from local admins and their account was deleted from the computer. Some of these users lost the "link" to their local profiles and I had to move all their stuff and set everything back up. I also had a lot of permission issues throughout the company such as RDC issues and read/write issues.

Sooooo! I am thinking about re-doing this a little bit the other way around and I want some input. This time, I am going to put the initial group as power users (local) and then set all my users as "members of this group:"

Do you guys see any repercussions to doing this? Is this the correct way to solve my problem?

Thanks a lot!


share|improve this question
Sorry, I am not following what you did, or where trying to do in your description in the second paragraph. – Zoredache Sep 17 '10 at 20:10
I have done a decent amount of research that says the best way to remove these users from local admins is to use the "Restricted groups" in a group policy. (Computer config ==> Windows Settings ==> Security Settings ==> Restricted Groups) – Cory Sep 17 '10 at 20:15
I'm confused. You say all the user accounts were deleted from the machine, but you obviously have Active Directory if you're using GPO, and as such there shouldn't be any local user accounts on the machine other than Administrator and Guest. Please clarify – Izzy Sep 17 '10 at 20:21
Sorry for the confusion and just now getting to the party. What I meant by "all the user accounts were deleted" or any confusion about local users is that when you go to control panel then go to users... this is where all the domain users that have logged into the machine and have a local profile. This is also where you can set them as admins or power users ect. Does this clear up any confusion? – Cory Sep 20 '10 at 12:29

Ok... I know this question is dead in the water but I finally put some time into this issue and got it solved.

What i did is I set Administrators(local) as the initial group and then in the members section, i put Domain\domain admins

Then I put my user group domain\Power Users as the initial group and in the members of, i chose power users (Local)

share|improve this answer

You can't use group-policies to add or remove users from groups. If local-users (or domain users) are a member of the local-administrators... you'll need to manually remove them... or create a script to do it for you & push it out as a logon script or some such. (just be sure to exclude "Administrator"... or any needed admin users)

As a rule... NEVER give users more permissions than the absolute minimum. They DO NOT ever need administrative privileges to do basic tasks. (Adding printers... can be done by the Printer Operators group... installing applications & drivers should be reserved to administrators only.)

If you have software from a 3rd party that insists on requiring Administrative privileges to run... they're either a) lying... or b) not a vendor you want to do business with. Install with admin, sure... but it shouldn't be required to run.

This is one of those rules people forget... and will always come back to haunt the admin.

It sounds like you have a lot of work in front of you...

share|improve this answer
don't need to manually remove them the gpo's restricted group will remove anybody thats not being enforced. There are a lot of poorly written apps unfortuanetly so you really need to understand your applications.. – tony roth Sep 17 '10 at 22:54
Tony Roth is right here. Last week, I set a GPO that when users logged in, it removed them from being a local admin. The problem was, not everyone logged in that day and the people who did had a lot of problems... So I decided to remove the GPO. On another note, it was unfortunately my predecessor who did this to all the computers and now I am fixed cleaning the mess and making the users hate me... – Cory Sep 20 '10 at 12:30

I disagree slightly with TheCompWiz in that in my field (education) you will often see older applications that do require administrative access to run, and which cannot be organizationally removed. That said, in those cases you generally want to use GPOs to restrict what the users are able to do. It won't necessarily cut down on the mischief that viruses and malware can unleash, but it may provide some hedges (depending on the policies you put in place) against the users creating those issues in the first place.

Novell's Zenworks product (which can be run with Active Directory or Novell's own eDirectory) has a feature called "Dynamic Local User" (DLU) which I believe comports roughly with what you are trying do to. It provides a policy that creates a new or manages an existing local user on a machine. Using DLU, you can change which groups a user belongs to at login. It has some other bells and whistles as well -- you can leave the local user on the machine or have it automatically deleted at logout, which gives you some flexibility for times when users may be using multiple machines or machines that jump on and off the network.

That said, you are probably not in a position to use Zenworks, so the scripting solution per TheCompWiz seems to be the best approach. I would advocate a script as follows: 1. When a named user (rather than a generic like "Administrator" or "Guest") logs into a machine ... 2. Check the local administrative group for the user 3. If the user exists in the group, then remove them. 4. Write a little log file to the user's directory with date stamp, username, and machine name to confirm that this was done.

You probably do want to re-word at least the title of your post for clarity.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.