local admins group policy

Posted on 2010-01-12
Medium Priority
Last Modified: 2013-12-12
i am using 2003 server to make domain users local admins on all computers. i am using the group policy managent with the restricted groups in security settings restricted groups. my problem is that when i select "domain computers" to apply to. it puts domains users  in my administrators group in active directory. making it an issue b/c then everyone can c everything administrators can. i have thought about making another group and putting all computers in that. or an ou and moving computer from the computers folder to the ou however i thought that might cause some problems. just thought i would ask the best way to accomplish this. the domain controller is not in the domain computers group however so i am not sure how it is applying. thanks in advance.
Question by:sbalk23
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 38

Accepted Solution

Shift-3 earned 2000 total points
ID: 26298162
First of all, don't add Domain Users to the local Administrators group.

If you have badly-written software that won't run under an ordinary user account, use Process Monitor to determine what files and registry keys it is trying to access.  Grant users permission to access those specific files and keys.

If that doesn't work and you absolutely must make users administrators on workstations, then add the local INTERACTIVE account to the local Administrators group.  This will give administrative privileges to the user who is interactively logged onto a workstation, but will not give them those rights to other machines over the network.
LVL 16

Expert Comment

ID: 26305950
any specific reason why you need to make users local admins on the workstations?

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Developer portfolios can be a bit of an enigma—how do you present yourself to employers without burying them in lines of code?  A modern portfolio is more than just work samples, it’s also a statement of how you work.
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This video demonstrates basic masking and how to edit the mask to reveal the desired image.
This video will demonstrate how to find the puppet warp tool from the edit menu and where to put the points to edit.

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question