2
votes
0answers
50 views

Windows 7 GPO Preventing admins from interactively logging in, but still allowing Run As / permission escalation

I'm implementing security restrictions for a client who would like to prevent admin accounts from logging into workstations. For example each person has a user account and an admin account and only ...
1
vote
1answer
231 views

Let users install software without local administrator rights on domain

I manage the network of a small company. As I'm not always in the office it is a wish from the employees to be able to install software without having to go to me. My predecessor set it up that ...
0
votes
1answer
34 views

Why does windows xp standalone group policy apply in the safe mode to the default administrator?

I am trying to turn standalone Windows XP installed on VirtualBox virtual machine into an AppStation-style machine (only one allowed application, taskbar, start with lone shutdown option, and a ...
1
vote
2answers
529 views

Restricted Groups not working

I have several GPOs set up on our domain at work, in one GPO I have the group set to be Local Administrators via the Restricted Groups feature. However, when one of the users in this group logs in to ...
0
votes
1answer
397 views

Administrator and Administrators Group difference Windows Server 2008 and 2008 R2

Sorry if this question is not unique. 1) Is there any difference in permissions between a user in Administrators GROUP and USER Administrator. 2) If they differ, are this differences the same for ...
4
votes
1answer
1k views

local admin vs domain admin on a domain controller

I would like to create a group policy to set a specific password for all local administrator users. Now even though you can't manage local users on a domain controller ("This snap-in cannot be used on ...
5
votes
6answers
14k views

How can I remove local administrator permissions?

I want to disable the permissions of local administrators in the machines of my domain, is this possible?, and only put administration rights to the Domain Administrators. And I want to do it with ...