P
Peter Downes
How do I create a group policy that will add the user that logs onto a PC
into the local administrators group on that PC?
into the local administrators group on that PC?
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
J
Jerold Schulman
See tip 5319 » How do I create a global group, so that it is a member of the local administrators group on all workstations and member servers, by using group policy restricted groups?How do I create a group policy that will add the user that logs onto a PC
into the local administrators group on that PC?
in the 'Tips & Tricks' at http://www.jsifaq.com
O
Oli Restorick [MVP]
Hi there
It depends on what you mean. If you want *any* user who is able to log in
to a given machine to be an administrator of that machine while they are sat
at the console, I have a good solution. It is to run the command "net
localgroup administrators interactive /add" as a computer startup script (so
that it runs in the system context).
If, however, you subscribe to the notion that each PC belongs to a primary
user and that each user only logs in to their own PC, then there isn't
really an easy way to automate this.
Microsoft KB article 320065 (as referred to by Jerold) is really only
suitable for trusted administrators needing admin access across all
workstations. If your users are even slightly clever, and you implement
this solution, your users could find out how to do things like:
* Take screenshots of other users' screens.
* Run arbitrary processes on other users' machine.
* Run VNC (or equivalent remote control package) on other users' machines.
All the above can be achieved without having physical access to the machine,
so be careful to think through what it is you are asking for and what it is
you choose to implement.
Hope this helps
Oli
It depends on what you mean. If you want *any* user who is able to log in
to a given machine to be an administrator of that machine while they are sat
at the console, I have a good solution. It is to run the command "net
localgroup administrators interactive /add" as a computer startup script (so
that it runs in the system context).
If, however, you subscribe to the notion that each PC belongs to a primary
user and that each user only logs in to their own PC, then there isn't
really an easy way to automate this.
Microsoft KB article 320065 (as referred to by Jerold) is really only
suitable for trusted administrators needing admin access across all
workstations. If your users are even slightly clever, and you implement
this solution, your users could find out how to do things like:
* Take screenshots of other users' screens.
* Run arbitrary processes on other users' machine.
* Run VNC (or equivalent remote control package) on other users' machines.
All the above can be achieved without having physical access to the machine,
so be careful to think through what it is you are asking for and what it is
you choose to implement.
Hope this helps
Oli
M
Manny Borges
Nice solution.
--
Manny Borges
MCSE NT4-2003 (+ Security)
MCT, Certified Cheese Master
The pen is mightier than the sword, and considerably easier to write with.
-- Marty Feldman
--
Manny Borges
MCSE NT4-2003 (+ Security)
MCT, Certified Cheese Master
The pen is mightier than the sword, and considerably easier to write with.
-- Marty Feldman