0

is it possible to prevent local administrators from leaving the current A/D domain by group policy? We are using Windows Server 2008 and Windows XP/7 as clients.

Thanks.

Improve this question
1
  • If a user is administrator and/or has physical access to the hardware there really is nothing you can do that will 100% prevent them from abusing the system in any way they see fit. If you have a person causeing problems remove their access, or remove the person.
    – Zoredache
    Nov 15, 2010 at 0:08

5 Answers 5

Reset to default
2

To the best of my knowledge, I don't think you can.

You can hide all the obvious routes to any function you like, but fundamentally a local administrator owns the box and can do what they want.

Improve this answer
2

I actually made an attempt at this at one point and had to give up. My only solution was to go another path and remove their local admin rights. Some quick googling brought back the same results I remember from last time.

Improve this answer
1

Not any way that I am aware of, however I would instead work on removing admin rights from the clients. Instead grant users only the rights they need. While there is usually political kickback and there will be exceptions, windows 7/2008 is actually very non-admin friendly. As an example one typical stumbling block is installing activex controls, in XP you simply had to have admin rights, under win7 you can set a group policy to allow specified websites to install controls.

Improve this answer
0

This is what I find out so long: You can't prevent a local admin from changing stuff in the system panel. But you can hide the whole system panel by using group policy in "User Configuration", "Policies", "Administrative Templates", "System Control" and then "Hide Specified System Control Symbols". To hide the System Panel (which includes Machine Name and Domain/Workgroup Configuration) use "Microsoft.System" as canonical name.

Note, I'm using a German version for Group Policy Management and I tried to translate the names, so they could differ ;-)

Improve this answer
0

You could attempt to hide the properties from My Computer / Computer

Don't remember of the top of my head where it is but if you need help finding it ill look In my GPOs

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .