Solved

Local admin rights on a domain connected workstation for ONLY the computer the user is actively logged into.

Posted on 2016-08-08
2
37 Views
Last Modified: 2016-08-12
I'd like to know if there is a way to assign local admin rights on a Windows 7 Pro PC that is connected to a domain, for ONLY the PC to which the domain user is currently logged into, not every PC that user may use.

Here is the scenario I'm dealing with: I have a group of domain connected computers that run a number of archaic legacy applications requiring local admin rights. Unfortunately, the PC's currently have the Domain Users AD group in the Local Administrators Group. I'm not pleased for with this scenario as I see the potential for malware to infect every computer setup in this manner, since the logged in user effectively has admin rights to every local PC on the LAN. Since I cannot immediately remove Domain Users from the Local Administrators Group, I'd like to know if there is a way to to assign the local admin right to the currently authenticated user on the PC to which they've logged in. Is that possible? Is there some group that I'm unaware of that could accomplish that task? I realize that I could just add only the user as the local administrator of the PC they're using, but these users tend to roam around quite a bit and it would increase the administrative burden on IT staff.
0
Comment
Question by:Brook_Lane
2 Comments
 
LVL 22

Accepted Solution

by:
Joseph Moody earned 500 total points
ID: 41747396
You can do this with Group Policy Preferences and the current user variable. Here is a guide on doing this: https://deployhappiness.com/clever-way-manage-administrative-rights-regular-users/
0
 
LVL 5

Expert Comment

by:Manuel Flores
ID: 41747425
There are users called;  SELF, Interactive logon users, authenticated user.  I think they could be added to admin groups.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains how to install and use the NTBackup utility that comes with Windows Server.
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

713 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question