We have windows 2003 AD domain in native mode. The domain user account is part of Local Administrators group in each PC. So Joe's domain user account is part of Local Administrators group in his workstation. I know this is a bad practice, but we have no choice at this time.
Some tech savvy users lock their PCs with either windows firewall or by some other means. When we, the domain administrators, tries to browse to their PC using computer management snap-in, we get either access denied error or errors similar to it.
Some users simply remove the domain admin account from the local admin group. But we made sure they can't by using the GPO. What other methods are available for the users to lock the workstations for the domain admins and how to prevent them?
Users can:
1) Stop the "server service"
2) Enable a firewall
3) Stop the "remote registry service"
4)...
5)...
Is there anyway to run a VBScript once every hour using a GPO? I don't want to use the scheduler service because the users can disable or delete it.
I realize the permanent solution is to take away the local admin rights, but we really can't at this time.
Thanks for you input.
Start Free Trial
