Context: I am a new junior sysadmin and I have inherited a small office workgroup of about 12 windows machines, production and backup fileservers, and a sql server. All user accounts on the fileserver are members of the Administrators group. I realize this creates a vulnerability. Additionally the brass would like to have certain directories on the fileserver off limits to the general users.
How can I remove my users from Administrators group, and get them into two tiers of regular accounts and avoid inconvenience, production downtime, etc.?
I'm all for automation if feasible, so I'm not scared of scripting in .bat files or powershell, although my powershell is rusty and my .bat scripting is hacky.