Hi Experts
In our network we have 500 workstations. Out of them 75 have another local admin account called "tester". All 500 workstations have administrator(local) as their local administrators group. These 75 system ALSO have "tester" in local admin group. I plan to use restricted groups GPO so only certain users and local admin has rights on all workstations which I can achieve using Restricted Goup GPO. My question is when I apply this policy it removes "tester" from local admin group for those 75 workstations. Is there a way in GPO or through script to restrict GPO from removing that particular user "tester"
I understand I can create diff OU and place those 75 workstations there and apply diff policy. But that would ne time consuming.
Also is it possible to create another local admin user through policy or scriptswhich I can apply for all workstations.
Appreciate your time
thanks
CJ
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
You nead to have an extra GPO defining that tester should be member of administrators.
One solution is as you mentioned to place the 75 computers in their own OU and link the extra GPO to that OU.
Another solution is to add the computers to a group, link the GPO to a higher common OU-level and modify the security for the GPO to only apply to the group including the 75 computers.
BTW, more interesting info, may come in handy:
http://support.microsoft.c
As far as creating local admin acct, take a look:
http://windows.stanford.ed
A minor typo in my reply about higher (nead to be lower in OU-structure than the original OU or modify priority if they're on the same OU-level)
As CynepMeH said you could also deny ACL for the normal GPO as a ACL-modification.
Keep in mind that last shout wins when applying GPOs (Local->Site->Domain->OU-s
user member of instead of members in the GPO
http://support.microsoft.c
http://windowsitpro.com/ar
Business Accounts
Answer for Membership
by: CynepMeHPosted on 2008-04-30 at 16:13:45ID: 21475369
1. Create a security group
2. Add computers to this security group
3. Deny the group read permission to the GPO
Have a beer and smile.