We have a global GPO that grants Local Admin permission to "Domain Users" via Restricted Groups. I was asked to remove the Local Admin to few users by applying a security filter on their computers. All the approaches I tried didn't work. do you have any idea ?

  • So it's your intention to let every user to be the admin of every users machine? – Jim B Oct 24 '15 at 3:27
  • Not mine, the decision was taken long time ago before my time. – Nazim Oct 24 '15 at 5:12
  • I'd strongly urge you to bring up the security risk to mgmt. Domain users as local admin means anyone at anytime has complete (potentially non-reputable) admin access to every client in the environment. If you want a complete list of why this is bad, you might ask over in the security stackexchange. – Jim B Oct 24 '15 at 17:54
  • We actually have Bit9 deployed , it does a pretty good job filtering and preventing users from installing softwares , unless the software is in a whitelist. But I agree , local admin has to be removed . – Nazim Oct 25 '15 at 20:00
  • so bit9 has a privilege higher than admin/system? – Jim B Oct 28 '15 at 4:48

Any GPO that target USER but got Computer setting must have the local loopback processing mode setting enabled.

Computer Configuration\Administrative Templates\System\Group Policy

Merge indicates that the user policies defined in the computer's Group Policy objects and the user policies normally applied to the user are combined. If the policy settings conflict, the user policies in the computer's Group Policy objects take precedence over the user's normal policies.

Check the order of the GPO too, as of course both of your GPO apply to him (domain user + the gpo with him).

  • Actually the GPO is targeting Computers, I enabled the loopback processing and enforced my GPO but didn't fix my issue. My GPO applies but won't remove the Domain Users from the local administrators group. I just noticed that the main GPO has the Security Policy Processing enabled with option to "Process even if the Group Policy objects have not changed". any thought ? – Nazim Oct 24 '15 at 14:57
  • @Nazim check the rsop then and the gpo order, as that gpo settings flush the other (its not merge, but replace). I mean, if two gpo for restricted group apply, the last one that apply win – yagmoth555 - GoFundMe Monica Oct 24 '15 at 14:58
  • @nazim Actually, i would isolate those pc in another OU to make only the settings you want to apply to them – yagmoth555 - GoFundMe Monica Oct 24 '15 at 15:05
  • I wanted to isolate them in a diffrent OU ,and copy the same main GPO without the Local Admin, but was told not to as we don't want a deep AD structure! – Nazim Oct 24 '15 at 15:11
  • @nazim, try it, if it work you will have last word. – yagmoth555 - GoFundMe Monica Oct 24 '15 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.