Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2008R2 DC (Just setup), we already had around 25 Windows 7 professional / ultimate clients, which we are now going to join to our new domain / dc. Users were already using the machines and were Local Administrators on that machine.

I want to deploy a USER via GPO which can either get created on every LOCAL windows 7 box and have Local admin rights or a Domain user which has LOCAL admin rights on every single PC on the domain (Windows XP, 7).

Will be grateful if someone could assist on this - I did tried my self creating a user but it won't get created, I used the Computer Settings group in GPO Edit to create the user.

Thanks for reading - will look forward to your guidance Rihatum

share|improve this question
add comment

3 Answers 3

up vote 8 down vote accepted

My first recommendation is that you wrestle those admin rights away from users. It'll make your life so much easier in the end. SO MUCH EASIER! Users have a tendancy to really mess up their computers when they're admins...Viruses, spyware, toolbars, junky freeware, change this settings, delete this file...just don't deal with it.

That being said, if you really have to give users admin rights, you can easily create a domain user which has local admin rights on each PC. Start by creating a user in AD. Then create a group policy and apply it to all workstations. In this group policy drill down to this:

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups

Add a new restricted group and make sure Domain Admins and the user you just created are members of it. This will not allow you to add any other local admin to these machines but will simply accomplish what you desire to do.

share|improve this answer
    
Hi Jason, Thanks for your reply, is there a way to delete any existing local admin users on client workstations via GPO ? then apply my Local Admin gpo onto the client machines? Also, if for e.g. the dc went down, would that local user (which we will create via GPO) still be able to access the machine locally ? Thanks –  rihatum Jul 4 '11 at 4:55
add comment

The other answers covered it well, but I'll just mention that Group Policy Client Side Preferences are another good option for managing local users and groups, with a bit more flexibility (but less client compatibility) than Restricted Groups.

share|improve this answer
1  
NB: It should have been installed as part of the regular updates, but the XP clients need a patch to allow the use of Client Side Preferences. –  Holocryptic Jun 17 '11 at 18:20
    
Hi @Holocryptic, what does NB means..? –  warl0ck Nov 13 '12 at 10:20
1  
@warl0ck en.wikipedia.org/wiki/Nota_bene –  Holocryptic Nov 23 '12 at 1:39
add comment

http://www.windowsecurity.com/articles/using-restricted-groups.html

Principles of security should be used. Create a desktop admin group, add you users to this, then add it to the restricted groups.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.