Local Administrator Rights

[napoleon]

Sponsored Links

Can anyone tell me the best way to give local admin rights to all users in the domain with Windows XP and 2003 AD? I checked that I can use the Restricted groups feature in group policy. However, I dont know how to do this? Can I simply add Domain users group to local Admin group? When this is done, then they can access each other's machin using C$. Will I be able to give them rights but prevent accessing the C$, or is there any other method to do this? Thanks.

[Dr.pter]

I think that domain users should be good. You need to avoid "Authenticated Users" because those include users of foreign domains as well and you would not require that. For administrative shares, I think this is something that you have to live with because users are local admins and have to power to do everything. But by doing a little tweaking, they can make GP settings undone. You can try to force client machines to not share C$ at all, since there is a custom ADM template around, or tweak share permissions on C$, but this would require scripting.

[Jeffrey]

As told by others, the best option is to make them not local admin. You need to convince the head of the department about the problem that could happen if they compromise the network with virus or malware.

[napoleon]

Thanks for the information, you guys are really good and I will definitely try to do what you have said.