Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 222
  • Last Modified:

Need help with Active Directory policies

Our intentions are to secure our windows XP machines, we are a large company using active directory on Server 2003.  We are trying to prevent domain users with local admin rights from creating a local account and being able to remove the PC from the domain.   We have removed the user accounts shortcut from control panel and locked down Local users and Groups in computer management and the MMC console and restricted the use of Regedit.  We need to accomplish two more things and I think we will have accomplished our goal.  

First prevent the use of the Net User command or any other command that can be used to create an account at the command line.  So that is my first question.  How do I do that using active directory?

Second, there is a post on this site that says you cannot prevent a local admin from removing a pc from the domain.  I am thinking that if I can use a policy to remove the computer name tab from System Properties  I will have essentially accomplished this.  Am I wrong?  And if this will work how do I do it?
1 Solution
i dont think you can block that net user command using GP - you may need to block off access to the run command console itself. there is a policy which restricts the use of certain applications that you specify, but if users have access to the cmd then they can run them from there.....

Administrative Templates\System\Prevent access to the command prompt

you also cant gide specifially the computer name TAB itself you will need to block the entire properties menu from my computer

User Config\Admin Templates\Desktop\Remove the properties from the my computer context menu

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now