User keeps changing settings. Please advise.

Ok, I'm a network tech for roughly 100-150 users.

 One user has unshared her C$ and has also disabled file and print sharing. She was trying to secure her machine , but instead made my job 10x harder. I can no longer access her computer remotely and will have to drive on site (30 miles) to change everything back.  This has been an ongoing problem since my boss refuses to implement ANY group policy what so ever. Furthermore, every user is an admin of their local PC.

Today I plan to
1. Put the default share back on her C$. She disbled it in the registry (I cant even connect via "Computer Management" anymore)
2. Re-enable file and print sharing.


What should I do? Downgrade her account to just a user?
Define some local policies (since its all I can do)?
dissolvedAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Debsyl99Commented:
Hi
You could downgrade her to a restricted user which would prevent all the above from happening again. If you keep any user as a local admin then they can pretty much do anything that they want to the local machine. If you define local policies then without some pretty clever tweaking you enable those policies for everyone, including yourself and yet as local admins they can still get in and change what you've done.

I'd keep a log of all the times that lack of group policy has caused additional unnecessary work, add up the real cost in time and expense and at some point when it's become outrageous, present it to your boss, who is the real baddy in this scenario,

Deb :))
0
dissolvedAuthor Commented:
THanks Deb.
I forgot to clarify that this is a domain account she is using. Not a local account. She has admin access to her local machine.   In other words, she is a member of her local administrators group.

If I make her a member of her local "USERS" group, will that solve the problem?
Thanks
0
Debsyl99Commented:
Yep - on the problem pc (lol on on every pc would be better!)- Run lusrmgr.msc from a command prompt on an admin logon and simply remove the domain account from the local administrators group and add it instead to the users group or at a push to the power users group - The only disadvantage with the users group is that there's very little that they can do locally, and they won't be able to install software. A great thing in my book, but depends on the needs of your company.

Deb :))
0
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

dissolvedAuthor Commented:
Is there a way to run lusrmgr remotely? Or is this something I have to do physically at the pc
Thanks for the help!
0
Debsyl99Commented:
Well you can do it using using startup scripts via group policy - but you can't use group policy......

But you can try this: If you can remote or login locally to a server, then you should be able open active directory users and computers snap in. Locate the machine, right-click and select manage. It needs to be online to do this. You can then administer membership from local users and groups remotely,

Deb :))
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
dissolvedAuthor Commented:
Thanks Deb
0
Debsyl99Commented:
Glad to help :))
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.