How to use restricted groups GPO's

Question

I am going through the process of removing all my users from local admins from their machines. I put each user as local admin when the box was imaged so I could avoid all the trouble. Well, now after a surge of users getting virus/malware I decided it's time to deal with the lesser of two evils.

I know that the best way of doing this will be through the restricted groups GPO. I attempted this last week while most of my users were gone and I had a pretty crappy morning and I reverted all the changes.

What I did was for the group, I specified Administrator (Does this automatically assume local groups? If when I browse and say local computer (being the dc) does that mean every computers local group?) and then I chose the (domain group) domain admins and put them in the "Members of this group:"

Correct me if I am wrong here... but when I did this, all user accounts (not profiles) were "deleted" from the computer. I am assuming this happened because since these users had been set to only local admins, when i set this policy it removed them from local admins and their account was deleted from the computer. Some of these users lost the "link" to their local profiles and I had to move all their stuff and set everything back up. I also had a lot of permission issues throughout the company such as RDC issues and read/write issues.

Sooooo! I am thinking about re-doing this a little bit the other way around and I want some input. This time, I am going to put the initial group as power users (local) and then set all my users as "members of this group:"

Do you guys see any repercussions to doing this? Is this the correct way to solve my problem?

Thanks a lot!

Cory

Answer 1

Ok... I know this question is dead in the water but I finally put some time into this issue and got it solved.

What i did is I set Administrators(local) as the initial group and then in the members section, i put Domain\domain admins

Then I put my user group domain\Power Users as the initial group and in the members of, i chose power users (Local)

Answer 2

You can't use group-policies to add or remove users from groups. If local-users (or domain users) are a member of the local-administrators... you'll need to manually remove them... or create a script to do it for you & push it out as a logon script or some such. (just be sure to exclude "Administrator"... or any needed admin users)

As a rule... NEVER give users more permissions than the absolute minimum. They DO NOT ever need administrative privileges to do basic tasks. (Adding printers... can be done by the Printer Operators group... installing applications & drivers should be reserved to administrators only.)

If you have software from a 3rd party that insists on requiring Administrative privileges to run... they're either a) lying... or b) not a vendor you want to do business with. Install with admin, sure... but it shouldn't be required to run.

This is one of those rules people forget... and will always come back to haunt the admin.

It sounds like you have a lot of work in front of you...

Answer 3

I disagree slightly with TheCompWiz in that in my field (education) you will often see older applications that do require administrative access to run, and which cannot be organizationally removed. That said, in those cases you generally want to use GPOs to restrict what the users are able to do. It won't necessarily cut down on the mischief that viruses and malware can unleash, but it may provide some hedges (depending on the policies you put in place) against the users creating those issues in the first place.

Novell's Zenworks product (which can be run with Active Directory or Novell's own eDirectory) has a feature called "Dynamic Local User" (DLU) which I believe comports roughly with what you are trying do to. It provides a policy that creates a new or manages an existing local user on a machine. Using DLU, you can change which groups a user belongs to at login. It has some other bells and whistles as well -- you can leave the local user on the machine or have it automatically deleted at logout, which gives you some flexibility for times when users may be using multiple machines or machines that jump on and off the network.

That said, you are probably not in a position to use Zenworks, so the scripting solution per TheCompWiz seems to be the best approach. I would advocate a script as follows: 1. When a named user (rather than a generic like "Administrator" or "Guest") logs into a machine ... 2. Check the local administrative group for the user 3. If the user exists in the group, then remove them. 4. Write a little log file to the user's directory with date stamp, username, and machine name to confirm that this was done.

You probably do want to re-word at least the title of your post for clarity.