Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having trouble managing a computer that is within my domain.

Login to our DC, I right click the computer, and select Manage: After connecting to a domain joined computer(windows 7), on the Local Users and Groups I have a Red cross, with an error that I do not have access to it.

I suspect that the local user (whom have local admin rights - don't ask! ) has done some configurations to it.

What are my options? if I do NOT have physical access to this computer?

  • If I disable the computer from the domain - will that be good?
  • any startup script?

My DC is W2K3 R2 His system is either W7 64bit

enter image description here

share|improve this question
up vote 4 down vote accepted

It's possible that the user removed the default nesting of "DOMAIN\Domain Admins" into the local "Administrators" group. Since the user has "Administrator" rights on the PC they can do that.

You could use "Restricted Group" policy to "force" this nesting, but the user could always take a virtual "crowbar" to their machine's registry and break Group Policy processing (since they have Administrator rights). Odds are good they won't do this, but they could.

Disabling the Computer Object would prevent anyone from logging-on with a domain account on the PC while attached to the network. It would be trivial to disconnect the network cable, logon with cached credentials, and re-connect the network cable, though.

This sounds like a management problem and not a technical problem. Assuming the user actually has done this I would think that running this problem up the management chain (since the user is, in effect, "breaking" an IT resource) is probably your best course of action. Trying to "fix" it with a technical "arms race" is a lose / lose scenario for you and the company. The computer doesn't belong to the user and they shouldn't be treating it like it does.

share|improve this answer
My first thought as well. – Jordan W. Feb 13 '12 at 15:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.