2

What I would like to do is grant permission for a domain account to log on to any server/workstation and be a local administrator with having to add this account to domain admin group?

This account only needs to be able to read folder sizes on all folders on a workstation/server.

Is there a GPO for that?

Improve this question
3

3 Answers 3

Reset to default
0

great how-to here: http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

Improve this answer
6
  • 3
    Posting only links is really frowned upon. You should put the relevant content in an answer and then link to your source.
    – MDMarra
    Dec 20, 2011 at 19:57
  • Thanks! I spoke to the network admin and we have a couple minor hurdles to jump over before we can do this, but your link is definitely going to help!
    – Dave
    Dec 20, 2011 at 19:59
  • @mdarra Do you have something on the site to back that up? I'd certainly rather have a link to a complete answer rather than an incomplete answer. Your remark certainly goes against John Skeets advice here msmvps.com/blogs/jon_skeet/archive/2009/02/17/…
    – Jim B
    Dec 20, 2011 at 21:21
  • @JimB Lucky for us, John Skeet doesn't run the Stack Exchange network. You should read this. There are also multiple posts on m.so about this where all of the most highly voted/accepted answers say to provide more than just a link.
    – MDMarra
    Dec 20, 2011 at 23:53
  • 1
    @JimB Also, the two are not mutually exclusive. I suggested leaving a summary AND the link. John Skeet even says this in the link that you provided : "it's worth including some sort of summary of what you're linking to - a link on its own doesn't really invite the reader to follow it, whereas a quick description of what they'll find there provides more incentive."
    – MDMarra
    Dec 20, 2011 at 23:55
2

You can use Group Policy Preferences to update whatever local group to contain whatever users you want it to, including the local administrators group.

GPP Screencap

Improve this answer
0

Yes, this is definitely possible with a GPO.

You need to be careful though, that the GPO that makes the user a local admin on every machine does not also apply to the domain controllers, because a local admin on a DC is a domain admin.

It's all just a matter of your particular OU structure, where the computer accounts are, if/how you configure "Enforced" or "Block Inheritance," and/or WMI filters. There are too many different ways to accomplish it to really go over them all.

For instance, a common scenario is to do something like apply a GPO to the "Accounting" OU that makes all members of the "Accounting Dept Admins" local administrators of all the computer accounts that reside in the Accounting OU.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .