Group Policy Local Admin Rights on PC's

We need to temporarily give everyone on our network local admin rights on their computers. Previously, we manually set up everyone as a Standard User on their computers. Recently, we created a Group Policy under Computer Configuration-->Windows Settings-->Security Settings-->Restricted Groups that makes Domain Users members of the Administrators (built-in) group on the local computers. But the users are still not able to run updates or install software on their own. I'm wondering if the manually configured Standard User setups are overriding the GPO. Is there a way around this? We're running Windows Server 2008 R2.
PerfishentAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Joseph MoodyBlogger and wearer of all hats.Commented:
Two things have to happen. First, the computer has to get the policy - a gpupdate or restart will do this. Second, the user has   to log back into the computer (if the computer wasn't restarted).

Run a gpresult on one of your machines to see what GPOs are being applied. Here is a guide on that: http://deployhappiness.com/gpresult-or-rsop/
0
Will SzymkowskiSenior Solution ArchitectCommented:
Using Restricted Groups does not require a reboot, and will update automatically. You can verify this by looking on a client machine and seeing Domain Users listed under Local Admins group.

However, even if the user has this policy applied they still need to logout and log back in, for the permissions to be applied. This is the same for when they have local admin permissions. Even if you take this away, and make them a standard user, they will have local admin rights until the logout of their machine.

Will.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
PerfishentAuthor Commented:
Domain Users is listed under the Local Admins Group. And we've had the employees restart their computers. But they're still not able to install or update software on their own.
0
Will SzymkowskiSenior Solution ArchitectCommented:
Do you have other application restrictions GPO's  or they simply cannot install any programs?

I have used this policy several times and all that is required is a log off. Can you verify that this is the same for all users?

Will.
0
PerfishentAuthor Commented:
This is actually working now. For some users, the change seemed to have taken longer than expected to go through.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.