Is there a way to give domain based accounts local admin access on specific machines and not others?
I can control access and rights to which machines a user can log in to and what their privileges are on a global scale but is there a way to control them on individual machines?
What we have now is an Active Directory group called Sec.LocalAdmin, we deployed this group 'Restricted Groups'. So every user that is a member of this group is local admin on every machine where this group is added to the Local Admin group. What we want is that every user is local admin on their own machine, is it possible to do this by a GPO?
msDS-PrimaryComputer
attribute.