Need help with Active Directory policies

Posted on 2006-03-22
Last Modified: 2010-04-18
Our intentions are to secure our windows XP machines, we are a large company using active directory on Server 2003.  We are trying to prevent domain users with local admin rights from creating a local account and being able to remove the PC from the domain.   We have removed the user accounts shortcut from control panel and locked down Local users and Groups in computer management and the MMC console and restricted the use of Regedit.  We need to accomplish two more things and I think we will have accomplished our goal.  

First prevent the use of the Net User command or any other command that can be used to create an account at the command line.  So that is my first question.  How do I do that using active directory?

Second, there is a post on this site that says you cannot prevent a local admin from removing a pc from the domain.  I am thinking that if I can use a policy to remove the computer name tab from System Properties  I will have essentially accomplished this.  Am I wrong?  And if this will work how do I do it?
Question by:pcs1111
    1 Comment
    LVL 48

    Accepted Solution

    i dont think you can block that net user command using GP - you may need to block off access to the run command console itself. there is a policy which restricts the use of certain applications that you specify, but if users have access to the cmd then they can run them from there.....

    Administrative Templates\System\Prevent access to the command prompt

    you also cant gide specifially the computer name TAB itself you will need to block the entire properties menu from my computer

    User Config\Admin Templates\Desktop\Remove the properties from the my computer context menu

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    So you have two Windows Servers and you have a directory/folder/files on one that you'd like to mirror to the other?  You don't really want to deal with DFS or a 3rd party solution like Doubletake. You can use Robocopy from the Windows Server 200…
    I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    732 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now