Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite
2

I'd like to create an account that is not a domain admin, so user cannot log into ADUaC, GP editor, etc but has privileges to access the Event Viewer, install printer drivers and applications on a client PC.

This will be for a student worker to help ease our workload and do basic troubleshooting. How can I create this type of ac

share|improve this question
4  
Every domain user can access ADUC, but not all can perform changes. – user106666 Jun 11 '12 at 14:10

3 Answers

up vote 7 down vote accepted

Well, it seems that all the privileges are needed on the client side of things, so just add the student worker as a local administrator on all the machines that they'll need access to. Give them a normal domain user account and use Restricted Groups in group policy to add the user to the local Administrators group of the client machines.

share|improve this answer
We have hundreds of PCs across a campus environment, classrooms, faculty and staff machines. Adding users locally, and I'm assuming manually, is not feasible option. – Sandy Jun 11 '12 at 14:10
2  
@Sandy: Group Policies are created, applied, and administered centrally, not at each client computer. The client machines that are in the scope of the gpo download and apply the settings. – Greg Askew Jun 11 '12 at 14:18
2  
There's a feature called Restricted Groups that will allow you to modify the local Administrators group of all domain computers using Group Policy. You can use this feature to make the user a local Admin on as many machines as you need to. – Safado Jun 11 '12 at 14:36
1  
It's worth adding that even the local Admin will have quite a bit of privileges, so a certain level of trust has to be placed with this Student Worker. This will provide you what you've requested, though. – Safado Jun 11 '12 at 14:39
2  
We added a domain group to all out clients local admin groups using group policy. We than add our desktop techs to this group and voila! – uSlackr Jun 11 '12 at 16:18
show 1 more comment
up vote 0 down vote

Create a security account that gives access to local machines on the domain. Add the computers to this security account, and add the security account to the user. So... to further explain that;

You have computer A, B and C and user USER1.

Create a Security group called LOCALAD.

Add this security group to computers A, B and C and to USER1.

This will give them access to the computers, but not the servers.

share|improve this answer
up vote -1 down vote

This seems like the a good fit for membership in the "Server Operators" and "Print Operators" domain groups.

share|improve this answer
   
I want this account not to have server privileges. I want them to have local administrator access on client PCs, and absolutely nothing on a server or domain settings. – Sandy Jun 11 '12 at 14:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.