Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My AD account gives me admin privileges on our PCs (allowing me to install software, add PCs to our domain, change network configuration, etc). But with a small handful of PCs (Windows 2000 and Windows XP) when I log in I only seem to have standard privileges.

It does accept my username and password so it must be talking to one of our domain controllers (can't be using cached credentials because it's the first time I'm logging into these PCs). I've tried pointing it to different domain controllers, but that doesn't make any difference.

I've tried refreshing group policy on the PCs, that completes without errors but doesn't make any difference.

I've tried moving the PCs into different OUs, including ones that other PCs work okay in, again it doesn't make any difference.

Asked my colleagues (who have similar accounts) to log in using their accounts. No difference.

What other things should I be checking?

share|improve this question
    
One thing that may or may not be related. When I use the runas command in a Command Prompt I need to include the machine name to use any of the local machine accounts. Otherwise it doesn't seem to recognise the accounts. –  Alistair McMillan Mar 31 '11 at 16:53
    
How is it that your account is granted local admin on the PC's? Are you a member of the Domain Administrators group? –  squillman Mar 31 '11 at 17:03

1 Answer 1

up vote 3 down vote accepted

I'd compare the local users/groups between a PC that works and one that doesn't. Specifically, I'd look into the local Administrator groups on a PC that works the way you expect, and see if there's a Domain group in there that isn't on the PCs that don't work correctly.

For example in our domain, domain administrators are under the group "Domain Admins" and then this group is added in the local "Administrators" group in every PC in the AD. This way every domain administrator is automatically a local administrator as well.

share|improve this answer
    
All our Service Desk personnel are members of a group that has been created specifically to allow certain rights. That group was missing from the local Administrators group on the PC. Added that group to the PC and now everything works as expected. Thanks. –  Alistair McMillan Mar 31 '11 at 17:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.