• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1584
  • Last Modified:

Creating a temporary local admin account for vendor for a group of computers

I'm very new to AD.  What I want to do is create a temporary local administrator account for a group of 5 computers that I can later rescind .  These would all have the same username and password.  The reason being is that our school has a vendor coming to set up 5 Smartboards and the associated software on 5 dedicated laptops. I want this person to have the rights to install the software and make sure everything works correctly.  I then want to delete this local administrator account when the job is done.

I know I can set up a temporary admin account on each computer but I am learning about the power of AD and would like to do the job once and have it affect those computers.

I am going to do the 1st step and set up a separate OU for these 5 computers. I was wondering if I could write a group policy that creates a local admin account on these computers with the same name and password?  As mentioned earlier, I am just learning about servers, AD, and GPO.

I also intend to leave this OU in place for future updates of software for these dedicated computers.  I appreciate any assistance.
0
Techman85
Asked:
Techman85
  • 2
  • 2
1 Solution
 
Krzysztof PytkoActive Directory EngineerCommented:
Yes sure. Create a standard domain user account for that company and create GPP (Group Policy Preferences) to apply it to that OU where 5 computers are located. Please check that
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/

if you have XP clients, you need to install Client Side Extension (CSE) first to be able to apply GPP
http://www.microsoft.com/en-us/download/details.aspx?id=3628

after all, you can simply disable that user account in a domain and remove GPP from OU

Regards,
Krzysztof
0
 
helpfinderIT ConsultantCommented:
Create user in AD with admin privileges.
In user properties set when account has to expire (Account tab), with this you do not forget to disable account, but will be disabled automatically.
On the same tab (Account) click "Log on to ... " and set hostnames of your 5 PCs - this will ensure user will be able to login only on specified PCs

This simple procedure does not need to create any policies and apply them, just one account and 2 settings for it. It should do all the work you expect.
0
 
Techman85Author Commented:
Thanks for the suggestions.  I tried helpfinder's suggestion since it was simple and seemed to do everything I wanted.  I followed the steps and created a user with admin privileges and set the hostnames of the computers in the "Log on to" section.  Once I logged off and back on again, I was able to log on with the newly created user.

However, when I tried to install a program, the UAC came on looking for credentials.  I typed in the username and password for my newly created account and got a message at the bottom, "The requested operation requires elevation".  I don't understand why that is since I set up the user with admin privileges in AD.  The target machines are Windows 7 Professional.
0
 
helpfinderIT ConsultantCommented:
what is you try right click on the program and click "Run as Administrator" option?
as option 2 you can try to turn off UAC for a while and check if your SW will be installed without problems with UAC turned off
0
 
Techman85Author Commented:
I tried making it work by turning UAC off and also tried "Run as Administrator", but no luck. It seems that the Administrator permissions gets stripped when going from a "Built-in Administrator" in AD to a Local Administrator. This seems to be a Windows 7 behavior and might have to do with the default disabled Administrator account. I used helpfinder's solution which worked as far as making an account and limiting it to those 5 machines with an expiration date. (I'll see if the account expires on Friday). I then went in locally with my Domain Administrator account and added user "smart" as an administrator.  I have a deadline so I don't have time to work with this any longer.
0

Featured Post

Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now