Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have active directory 2003 and windows xp running on clients so I don't want any of my users to have any admin rights on their PCs and I have already gave them local admin rights So Without to go to each PC and remove it by hand . How can I remove my users from local admin rights with a GPO? Any advice would be appreciated Thanks

share|improve this question

Restricted Groups

Computer configuration > Windows Settings > Security Settings > Restricted Groups.

If you set that up with Using the "Members" Restricted Group Portion of Policy, it will remove anything else that is listed locally. It will only apply the group that is in your policy. You can read more about it here

share|improve this answer
Be careful with this. If you don't add Domain Admins to the restricted group, you'll find yourself unable to administer the machines. – Jason Berg Jun 8 '11 at 13:32
Good catch! Thanks for the reminder – Nixphoe Jun 8 '11 at 13:33
Sorry I'm haven't understood you When I have added the users in local admin right I did by client side I wen to each one and used administrator account I added the user so already I dont have this policy. May I have create new one or what I have to do to remove administrator users locally? – Codey Jun 8 '11 at 13:55
restricted groups will ensure that only the users in the restricted groups policy are in the local group. it doesn't matter if you changed the group membership onthe client. – Jim B Jun 8 '11 at 15:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.