0

This is a new domain controller. I created users and created a security group called Local Admin. The users are members of this group. I created a domain group policy and used the Restricted Groups policy to add the Local Admin group to the Administrators group of the clients (Computer configuration > Policies > Security settings > Restricted Groups > New > Local Admin > Member of > Administrators)

The weird thing is that when those users login at the clients they have access to \server_name\c$ (admin shares). Access is denied when I delete a user from the Local Admin group.

Why can a client administrator access those shares?? Or am I doing something terribly wrong?

  • IS this in a domain? Did you create a local group policy or if it was a domain did you create a domain group policy – Drifter104 Jul 22 '16 at 14:57
  • Yes, this is in a domain and I created a domain group policy – abbert Jul 22 '16 at 15:00
  • I created users and created a security group called Local Admin - Where did you create the users and this group? In AD? The weird thing is that when those users login at the clients they have access to \server_name\c$ (admin shares). - What are these clients that these users are logging on to? Workstations? Servers? Where did you link this GPO? – joeqwerty Jul 22 '16 at 15:01
  • These are AD users and they log on to a workstation in the domain. – abbert Jul 22 '16 at 15:03
  • Can do you a screenshot of your group policy management console and show where your group policy linked (so expand the tree) and show where your server is located within the tree (OU). Feel free to blank details, just need to see where each is located/linked – Drifter104 Jul 22 '16 at 15:04
2

Your group policy is giving your users local admin rights to the server because the default domain policy applies to the server, unless you have made some other changes but it would appear you have not.

Best practice - Leave the default polices alone (or at least don't add to them).

Create a policy for groups of settings, so in this case you might make a "local security groups" group policy and configure it to add any groups you wish to add locally.


To resolve your current issue.

1) Locate where the server is within the Active Directory domain (what OU it is in).
2) Remove the changes you made to your default domain policy
3) Create a new policy in the same OU of the server add your settings to this new GPO. Technet
4) Do a gpupdate and test access.

With regards to step 3, there are other ways of targeting GPOs but this is by far the simplest, espcially if you are just starting out managing them

  • If the server is in the same OU as your client machines, you have some options, but I will add that to the answer if it is the case. – Drifter104 Jul 22 '16 at 15:19
  • Hi, thank you for the answer.I made a new GPO and linked it to the OU where my client pc's are in. I then added the same settings (restricted groups) but still the same result remains. When I do a gpupdate then those users are given access to \\server\\c$ (I made a new OU for the clients) – abbert Jul 24 '16 at 21:23
  • I see that my new group "LocalAdmins" is also in the group Administrators on the server itself – abbert Jul 24 '16 at 21:29
  • I removed that entry and did a gpupdate on the server. LocalAdmin is not added anymore. Looks like evertything is working ok now.. :) – abbert Jul 24 '16 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.