We help IT Professionals succeed at work.

Need help with Active Directory policies

pcs1111
pcs1111 asked
on
Medium Priority
241 Views
Last Modified: 2010-04-18
Our intentions are to secure our windows XP machines, we are a large company using active directory on Server 2003.  We are trying to prevent domain users with local admin rights from creating a local account and being able to remove the PC from the domain.   We have removed the user accounts shortcut from control panel and locked down Local users and Groups in computer management and the MMC console and restricted the use of Regedit.  We need to accomplish two more things and I think we will have accomplished our goal.  

First prevent the use of the Net User command or any other command that can be used to create an account at the command line.  So that is my first question.  How do I do that using active directory?

Second, there is a post on this site that says you cannot prevent a local admin from removing a pc from the domain.  I am thinking that if I can use a policy to remove the computer name tab from System Properties  I will have essentially accomplished this.  Am I wrong?  And if this will work how do I do it?
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2006
Commented:
i dont think you can block that net user command using GP - you may need to block off access to the run command console itself. there is a policy which restricts the use of certain applications that you specify, but if users have access to the cmd then they can run them from there.....

Administrative Templates\System\Prevent access to the command prompt


you also cant gide specifially the computer name TAB itself you will need to block the entire properties menu from my computer

User Config\Admin Templates\Desktop\Remove the properties from the my computer context menu

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.