Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Allowing users local administrative rights

Posted on 2007-03-29
9
Medium Priority
?
252 Views
Last Modified: 2010-04-20
Hi Fellow Geeks !
Can anyone tell me how OR point me to a step by step guide on how to do the following.
I have a Win 2003 standard server running as DC...2x desktop PC's & 4 laptops. One user needs to have admin access when logging on to some computers EXCEPT DC.. How can I acheive this ??
Thanks in advance !!
John
0
Comment
Question by:mrmad1966
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +2
9 Comments
 
LVL 2

Expert Comment

by:emiops
ID: 18817879
promote his AD account on each computer (since you dont have that many to manage) to local administrator.

Control panel, user accounts, then find his AD account on the domain.

0
 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 18817904
Bad idea, putting his account in the local admin group on all machines.  This is a nightmare to manage.

If you MUST make him a local admin (NEVER a good idea, but there are some poorly written software programs that require it), then create a group in Active Directory - something called "Local Admins" or something like it - then put the user in that group.  Go to each workstation and put the "local admins" group into the local "Administrators" group.  By doing this is becomes VERY easy to remove the user from the local admins on all workstations and likewise, very easy to add another user if you need to.
0
 
LVL 2

Expert Comment

by:emiops
ID: 18817972
suppose you can do that too... same result... easier to manage

Keep in mind that it is problably better for that user to have atleast 2 AD accounts.  One for normal use, and the other to use only when he needs Admin rights (to install applications and so on) so he isnt always on as a local admin when he doesnt need to be.
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 1

Author Comment

by:mrmad1966
ID: 18818325
Hi all..
leew's answer does do the job, but if my network were larger or geographicaly different, is there no other option than edit the local Users Group on each workstation...??? Thanks
0
 
LVL 4

Expert Comment

by:vnicolae
ID: 18818349
You can create a GPO that adds a user to the local administrators group. It all depends on what you want to do exactly. What rights do you want this super-user to have?
0
 
LVL 1

Author Comment

by:mrmad1966
ID: 18818442
I'd like him to be able to install software..But obviously NOT on the DC. I do not want him to be able to log on locally to the DC!
0
 
LVL 4

Expert Comment

by:vnicolae
ID: 18818519
If you want them to install software, you have to give them local administrator rights. Either add them manually to the local group or via GPO.
0
 
LVL 2

Expert Comment

by:emiops
ID: 18818571
I am not sure how to use GPO to do what vnicolae is saying, but

If you create multiple GPO's that correspond with the different OU's in AD you can push GPO Updates to your computers while skipping your DC.

But for a 6 computer domain... Might just be easier to do what me or leew said at the beginning.
0
 
LVL 48

Accepted Solution

by:
Jay_Jay70 earned 2000 total points
ID: 18820423
mrmad1966,

I understand the predicament here and have seen it many time due to crappy software - though its been made a little to complex...

Restricted groups will take care of membership
http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

As far as the DC side of things goes - edit the default domain controllers policy - computer config - windows settings - security settings - user rights assignment - allow logon locally...just add your Administrator and any other explicit allows.

Regards,

James
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Suggested Courses

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question