ad - getting the right workstation permissions

hi all, have been wrestling with this problem for a few days now:

"confers full rights on the workstations, but not necessarily anything special on the domain"

"Normally to grant all users admin privilages on a machine you might consider creating a group, say SEC-Client Admins. Now put the domain users group into that group, and add the SEC-Client Admins group to the local admins group on each machine via GPO"

can anyone help with the above?

thanks in adavance,

Who is Participating?
youre1mConnect With a Mentor Commented:
Stick the machines in question into an OU, and then create a new GPO and
link it to that OU.

Then, in that OU, navigate to Computer Configuration\Windows
Settings\Security Settings\Restricted Groups.

Right click in the right pane, and choose "Add Group"

Don't browse, but type "Administrators"

When it is created, Add members to it.

Make sure you add "<Domain>\Domain Admins" and "Administrator" (the default
members of the local admins group) otherwise these will be removed when the
GPO propagates.

Cyber-DudeConnect With a Mentor Commented:
In order to provide administrative rights for local users (but not let them controll anything) is by using the runas command...

Also, you can edit groups (or create your own groups) by using the Security Group Policy Editor... Designate the users you wish to designate and let'm work....

commsxlAuthor Commented:
hi guys, thanks for the response.


" Don't browse, but type "Administrators" "

i've tried this, but then i can access \\domaincontroller\c$


i'm not sure where to begin with policy groups
Train for your Pen Testing Engineer Certification

Enroll today in this bundle of courses to gain experience in the logistics of pen testing, Linux fundamentals, vulnerability assessments, detecting live systems, and more! This series, valued at $3,000, is free for Premium members, Team Accounts, and Qualified Experts.

Yeah sorry I see what it's done, it's put the group into the domain admins group. Still trying to find a way though, I know it can be done.
I see your point... Its not an easy job if you wish to recreate default policies...

Go to the following link:

It might be helpful...

commsxlAuthor Commented:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.