group policy preferences to disable local administrator account not working

I am attempting to disable the builtin local administrator account using group policy preferences.
My Domain is a mixed 2003\2008 domain and the computers I am trying to disable the local admin account on are win xp pro. (with the client side gpo updates installed) I am able to create other accounts locally on the machine and set the password and permissions with group policy but the settings I try to apply to the builtin local administrator account are not working.

thanks
LVL 2
mattolanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

CPetrich12Commented:
Take a look at this page, it offers some good solutions to your problem. The one that I use more often than not is renaming the administrator account and setting a strong password, but it also walks you through disabling the account through GP.

http://www.windowsecurity.com/articles/Protecting-Administrator-Account.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mattolanAuthor Commented:
Ok, gave it a shot and id doesn't seem to be working .do you know if that group policy setting needs to be applied at the domain root level. I know some of those security settings like password settings only work if they are applied at the domain root level. I don't want to apply this to my entire domain. just my desktops if that is the case.

The setting in the article you posted is different from the settings I was origianlly asking about.
I was playing arround in the "Computer>>Preferences>>Control Panel settings>>Local Users and Groups" area originally
0
Malli BoppeCommented:
You don't need to apply on the domain level.It should be applied to the workstations OU.
Run gpresult /z on the workstation to see if the GPO is getting applied.
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

mattolanAuthor Commented:
This policy is not very clear, Should I enable the policy or disable the policy to disable the administrator account?
0
Malli BoppeCommented:
Just enable it and on the workstation run gpupdate /force from command prompt.
If it prompts for a restart or log off do it and check the administrator account.

Did you actually check if the GPO is getting applied by running gpresult /z or you run rsop.msc from the command prompts
0
mattolanAuthor Commented:
Yes I did. here is the result

            GPO: Disable Local Administrator Account
                Policy:            EnableAdminAccount
                Computer Setting:  Enabled
0
Malli BoppeCommented:
So did it work I mean did it disable the account.
0
mattolanAuthor Commented:
Sorry for the slow responce. Yes this does seem to work,  although the policy has very little explanation and the working is not so good. I had to set it to disabled to disable the admin account
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.