Determining who is running with administrator rights?

Question

I work at a small non-profit organization with about 55 desktop PCs running Windows XP Pro. The domain controller is running Windows Server 2003. I have a two-part question (note that I'm a bit of a newb when it comes to network administration).

Part 1: Is there some simple way that I can determine which accounts are logged in with administrator rights?

Part 2: Is there a way that I can remove administrator rights from users without sitting down at each individual machine?

Thanks for considering my questions.

Answer 1

For part 2, you can create a restricted groups Group Policy, and use that to enforce the membership of the local Administrators group on the workstations. Link that GPO to an OU high enough in AD so that all workstations are under it, and specify a WMI filter for the GPO so that it only applies to Windows XP workstations.

You probably don't need part 1 if you implement part 2.

Answer 2

A more low-tech method to achieve #2 is to pull up compmgmt.msc from the run box, and connect to the other workstations via hostname or IP. Only slightly better than sitting at their desk, and the change won't take effect of course until they log off, but handy if you can't use GP.

You can get the information in #1 by scripting, whatever works best for you - vbscript, powershell, perl. Some creative googling will get you some sample code.

Answer 3

For a quick way to see what accounts are currently logged onto each machine grab a copy of loggedon2 (Google it to find dozens of different download sources).

Both 1 and 2 can be done through scripting. I don't have any links handy but with a little searching you should turn up quite a few examples of remotely managing user accounts through a variety of scripting languages. Some I've seen in the past are very creative indeed.

Answer 4

The easiest way to check if you are admin is to double click the clock in the system tray. Only admins are allowed to change system time. If TCP IP is connected try

 dir \\%computername%\c$ 

Again only admins can navigate to the c$ shares. The %computername% represents the machine name the code is running on and can be used in scripts with the errorlevel return code.