For the first time, I'm able to add new Windows workstations to my domain. [For years we had a "standalone" 2k server, not a DC, and all our workstations were Windows Home] Now I have some new Windows 7 Pro workstations I would like to join to the domain. When I do, the only login that can resolve UAC challendges when installing software on the new workstations is "Administrator" for the server. From one of the items in "Related Questions", I found only "Administrator" works because my other administrator logins are for the server, not the domain.
I need users to have complete local control and the ability to install their own software. I create "admin" accounts on the local machine but of course they do not override the permissions in Active Directory. I've read a great deal about "Restricted Groups" and the Group Policy Object Editor and creating a localAdmin group, but my domain's Policy Object tree looks nothing like the examples I've seen. Is there an easier way? Can I do something with the user access permissions for each workstation under myDomain\Computers? If not, where can I find a primer on constructing the proper policies and permissions from scratch? Thanks