xavier_amala
asked on
How to provide admin access
Hello guys
in my organization, i need to give some admin access in domain like he is a helpdesk guy, so he needs to install new machine, add printer, do some small jobs on server, but i dont want him to have domain admin access is there is any way i can give such access?
Thanks in advance
Suresh
in my organization, i need to give some admin access in domain like he is a helpdesk guy, so he needs to install new machine, add printer, do some small jobs on server, but i dont want him to have domain admin access is there is any way i can give such access?
Thanks in advance
Suresh
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hey
let me explain clearly, i created a group called " Domain Helpdesk" and addedd two Helpdesk guys as the member of this group, i need to add this group to all my workstation at a time without going to each machine and add mannually... Please Help
Thanks Again
Suresh
let me explain clearly, i created a group called " Domain Helpdesk" and addedd two Helpdesk guys as the member of this group, i need to add this group to all my workstation at a time without going to each machine and add mannually... Please Help
Thanks Again
Suresh
You're halfway there:
Next create a computer startup script in a group policy that gets applied to all of your computers in active directory. In that script add the line:
net localgroup administrators "domainname\Domain Helpdesk" /add
You will need to put your domain name in before the \ in the previous statement. When the computers startup they will process this command from group policy and add the "domain helpdesk" group to the local administrators group on any workstation that runs the policy.
Next create a computer startup script in a group policy that gets applied to all of your computers in active directory. In that script add the line:
net localgroup administrators "domainname\Domain Helpdesk" /add
You will need to put your domain name in before the \ in the previous statement. When the computers startup they will process this command from group policy and add the "domain helpdesk" group to the local administrators group on any workstation that runs the policy.
ASKER
Hey
i am not able to add this in Group policy help how to do this for a special OU
Thanks
i am not able to add this in Group policy help how to do this for a special OU
Thanks
When you say 'special OU' are you referring to the default computers OU? If so you will not be able to add a group policy on this OU level (It would have to be done at the default domain policy which I wouldn't reccomend). In most organizations I've worked at we have always organized our computers under a new OU called Domain Computers (or whatever else you would want to call it). You can organize them however you want beneath that level (site, department, etc...) but this gives you a place other then the default domain policy to add group policies. My tree looks something like this:
Domain Computers - All client computers
Domain Controllers - All DCs
Domain Servers - All servers
Domain Users - All User Accounts
If your computers are in the default special folder I would suggest creating a new OU to house them in. They will still get the default domain policy and any other GPOs that are being pushed down.
Domain Computers - All client computers
Domain Controllers - All DCs
Domain Servers - All servers
Domain Users - All User Accounts
If your computers are in the default special folder I would suggest creating a new OU to house them in. They will still get the default domain policy and any other GPOs that are being pushed down.
ASKER
Hey
You are ture, i have all my computers except servers on default computers, i am planning to create new OU for all client computers.What should i do after creating another OU and move all my client computers.
Thanks
You are ture, i have all my computers except servers on default computers, i am planning to create new OU for all client computers.What should i do after creating another OU and move all my client computers.
Thanks
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hey
i create the GPO i can see the script running at backgroud when i login from my mahcine but for some reason its not adding the Admin group
Here is my script
net localgroup administrators "Domain\DomainHelp" /add
I saved this as BAT file and saved under statup script on C:\windows\Sysvol\Policies \702.....\ machine\st artup\..
i dont where i do mistake
Thanks for help
i create the GPO i can see the script running at backgroud when i login from my mahcine but for some reason its not adding the Admin group
Here is my script
net localgroup administrators "Domain\DomainHelp" /add
I saved this as BAT file and saved under statup script on C:\windows\Sysvol\Policies
i dont where i do mistake
Thanks for help
What happens when you do
net localgroup administrators "Domain\DomainHelp" /add
from a command prompt? Does the group get added?
Also, are there any GPOs that are making changes in the Restricted Groups?
If there is, that is the problem.
net localgroup administrators "Domain\DomainHelp" /add
from a command prompt? Does the group get added?
Also, are there any GPOs that are making changes in the Restricted Groups?
If there is, that is the problem.
This should run under the computer startup script (not the user login script). This should run before you login to the computer. Double check the GPO and make sure it is a computer startup script.
ASKER
Hey
let me check this
Thanks
let me check this
Thanks
ASKER
Hey guys
i checked again but still not working, i have added my scipt on GPO
computer configuration --> Windows Settings --> Scripts --> Start up --> <Script.bat>
do i need to specify anything on Parameters?
Please help
Thanks
i checked again but still not working, i have added my scipt on GPO
computer configuration --> Windows Settings --> Scripts --> Start up --> <Script.bat>
do i need to specify anything on Parameters?
Please help
Thanks
What happens when you do
net localgroup administrators "Domain\DomainHelp" /add
from a command prompt? Does the group get added?
net localgroup administrators "Domain\DomainHelp" /add
from a command prompt? Does the group get added?
Earlier you had mentioned the group name was Domain Help (With a space). That would neccesitate the syntax to read thusly:
net localgroup administrators "<Your domain name>\Domain Help" /add
net localgroup administrators "<Your domain name>\Domain Help" /add
ASKER
Hey
Net localgroup administrators "<Domainname\DomainHelp" /add this works in command prompt and the group get added, but not through GPO
Thanks
Suresh
Net localgroup administrators "<Domainname\DomainHelp" /add this works in command prompt and the group get added, but not through GPO
Thanks
Suresh
If you have verified that the script is set to run under the computer configuration and it's still not running,
I would enable logging to see what the errors are.
I would enable logging to see what the errors are.
ASKER
Hey Guys
It works fine, i am a dump i didnt restart the machine.. Sorry
Thanks
Xavier
It works fine, i am a dump i didnt restart the machine.. Sorry
Thanks
Xavier
ASKER
let me try this monday morning and i will let you know
Thanks
Suresh