Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to disable the permissions of local administrators in the machines of my domain, is this possible?, and only put administration rights to the Domain Administrators. And I want to do it with Group Policies.

Mainly I want to disable the permission of install/uninstall programs to the users, although they are Local Administrators of their machines.

share|improve this question
up vote 4 down vote accepted

Take the users out of the "local admins" groups.

The manual process would be to go to the computer, start > rc my computer and then "Manage Computer". Select "Local user and groups", "groups" then double click administrators. Remove the users from that group.

Probably best not to take Domain Admins out of this group though, and if you disable the local administartor group from doing anything, you may have other issues.

You may find that a lot of things will stop working for the users though, so Power Users might be the best place for them to go if they've done anything weird and wonderful.

If you wanted to do this by group policy, I think you'd be looking at scripting something, then having it run as a startup script.

Your script would then use "net localgroup administrators naughtyusers /delete"

share|improve this answer

As @Tubs has said, don't try and cripple the local administrators group. Just don't put your end users in that group. Power Users will give them permission to do pretty much everything that an admin can do, but not change system wide configuration. Although they do have modify rights to the registry so given time and a reg file, I can't see there being any setting that they couldn't change.

Group policy can directly control the membership of local groups. I don't have the admin tool available at the moment, but it is something like "restricted groups". What you specify here will become the complete membership of the group, you can not instruct group policy to make changes to membership of a local group, only completely replace the membership with the list you specify, so remember to include domain admins in the administrators group.

share|improve this answer
Didn't know that ones existed! Computer Configuration > Windows Settings > Security Settings > Restricted Groups. Much better than my suggestion. – Tubs Jul 9 '09 at 13:17

I don't have enough rep to comment on @pipTheGeek, but the path in GP is Computer Configuration\Windows Settings\Security Settings\Restricted Groups.

share|improve this answer

There isn't an easy way to deny local admins the right to install software. You could change the permissions on C:\Program Files and on various registry keys, but of course being local admins the users have the rights to change the permissions back.

The only good way to do this is create a new group that gives your users the rights they need, and keep the users out of the local admins group.

Alternatively use some form of audit to spot when they've installed anything they shouldn't.

This was a big issue when spyware was so prevalent, but most modern AVs are pretty good at stopping spyware installations.


share|improve this answer

Simple CMD command: NET LOCALGROUP administrators [UserName] /delete

share|improve this answer

If you are using Win2008 Group Policy Extensions there is a way to modify the Local Admins group rather than totally overwrite it as the Restricted Groups Policy does.

Take a look at this article:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.