Group Policy and User Group Membership?

  • Thread starter Thread starter KA Kueh
  • Start date Start date
K

KA Kueh

Dear all,

Is it possible to user Group Policy to restict a certain group of users from
being elevated to Local Administration Group? I mean if they happen to know
the local admin password, it is possible to change the group setting on
their PC. Thanks.

Regards,
Kueh.
 
2 ways to fix the problem. 1: Change the local admin password 2: create a
computer startup script in a GPO and link it to the OU that the "problem"
users computers are in with the following command in the script.

net localgroup "administrators" "<domain>\<user>" /delete

now, everytime the computer is restarted it will run that script to delete
the users from the local admin's group. Also...since they may already be
setup as a local admin, put that script into a user login script also just
incase they dont reboot their computers. Then when the login it will remove
them...they log out...next day come back to logon and no more admin! Hope
this works for you!

Philip Nunn
 
Dear Philip,

How about demoting them to Power User only since that they are now in the
Local Administrator group? Thanks.

Regrads,
Kueh.
 
Back
Top