making all users an admin of local machine by default

  • Thread starter Thread starter Mostro
  • Start date Start date
M

Mostro

I apologize for having posted in two groups. Was not sure which group was
more appropriate. My question is, what can I do to make sure that any user
that ever logs onto any Windows 2000 workstation on my network is
automatically an admin locally to that machine. I am hoping to find a
solution short of making them domain admins. Someone please help, and thank
you.
 
Well, you do exactly what you are asking ... Make "Domain Users" a member of
the local PC "Administrators" group ... Of course, then you have no security
whatsoever over your PCs, but if that's what you want ...
 
If you really want to do it, add the domain users group to the local
administrators group of each machine. You could use restricted groups to do
that with Group Policy as described in the link below, but I believe all
computers need to be upgraded to SP4 as there was a bug preventing proper
use of adding groups before and be sure to do it at the OU level and check
your results so as to not accidentally add domain users to the domain built
in administrators group. If you are not using SP4 it is still worth a try
otherwise you will need to look into using a startup scritp solution using
"net localgroup" or such. --- Steve

http://www.jsiinc.com/SUBK/tip5300/rh5319.htm
 
thanks

Steven L Umbach said:
If you really want to do it, add the domain users group to the local
administrators group of each machine. You could use restricted groups to do
that with Group Policy as described in the link below, but I believe all
computers need to be upgraded to SP4 as there was a bug preventing proper
use of adding groups before and be sure to do it at the OU level and check
your results so as to not accidentally add domain users to the domain built
in administrators group. If you are not using SP4 it is still worth a try
otherwise you will need to look into using a startup scritp solution using
"net localgroup" or such. --- Steve

http://www.jsiinc.com/SUBK/tip5300/rh5319.htm
Click to expand...
 
thanks

Ron Bernier said:
Well, you do exactly what you are asking ... Make "Domain Users" a member of
the local PC "Administrators" group ... Of course, then you have no security
whatsoever over your PCs, but if that's what you want ...
Click to expand...
 
I apologize for having posted in two groups. Was not sure which group was
more appropriate. My question is, what can I do to make sure that any user
that ever logs onto any Windows 2000 workstation on my network is
automatically an admin locally to that machine. I am hoping to find a
solution short of making them domain admins. Someone please help, and thank
you.
Click to expand...

Add the "domain users" global group to the "administrators" local
group on the workstation.

Jeff
 
Well, you do exactly what you are asking ... Make "Domain Users" a member of
the local PC "Administrators" group ... Of course, then you have no security
whatsoever over your PCs, but if that's what you want ...
Click to expand...

No security other than the user having to validate against a domain
account of course...

Jeff
 
Mostro said:
I apologize for having posted in two groups. Was not sure which group was
more appropriate. My question is, what can I do to make sure that any user
that ever logs onto any Windows 2000 workstation on my network is
automatically an admin locally to that machine. I am hoping to find a
solution short of making them domain admins. Someone please help, and thank
you.
Click to expand...

If you want to make sure that all users logging in interactively on a
workstation get administrator privileges you can add the object NT
AUTHORITY\INTERACTIVE to the local Administrators group. This makes sure
that only interactive users get administrator privileges but users
connecting from the network are still just normal users.
 
Jeff Cochran said:
No security other than the user having to validate against a domain
account of course...
Click to expand...

Which also stands true for the virus / application / trojan running on the
interactive account. That was his point. In other words, all of a sudden,
the domain logon validation makes all files accessible locally to any
infectious agent.
 
Which also stands true for the virus / application / trojan running on the
interactive account. That was his point. In other words, all of a sudden,
the domain logon validation makes all files accessible locally to any
infectious agent.
Click to expand...

Versus all files that are accessible in either case?

I won't argue the point. There are valid reasons for denying local
admin, as well as valid reasons to allow it. As long as you
understand the risks and mitigate them, feel free to deal with the
issue as you and your organization see fit.

If you want the full arguments to understand the issues better, Google
will give you plenty.

Jeff
 
Versus all files that are accessible in either case?
Click to expand...

What? run as... /admin, for example, does not provide system-wide access to
the interactive logon. Thats why NT4 based systems provide User-level
security. Shift + right-click a shortcut, see run as... in the context menu?

Using an alternate, elevated account has been part of NT since NT was
created. You can run multiple applications, each with its own account
right/privilege, on the same system simultaneously without ever needing to
logoff.

In fact, operating a client or server with an ordinary account and executing
administrative tasks with an elevated account, without a logoff, is how W2K
is designed to be operated. The same applies to NT and XP as well as all the
OSs that will be released in the future. Its akin to the Unix or Linux
Superuser (SU) concept as well.
I won't argue the point. There are valid reasons for denying local
admin, as well as valid reasons to allow it. As long as you
understand the risks and mitigate them, feel free to deal with the
issue as you and your organization see fit.
Click to expand...

What? Denying local logon to local admin? There is no reason to even
consider such a ridiculous concept. You have a serious miss-understanding of
W2K and other nt-based OSs.
If you want the full arguments to understand the issues better, Google
will give you plenty.
Click to expand...

Speaking of Google, here is a document that explains the issue. Hopefully,
it will shed some light in the alternate login concept.
http://www.winnetmag.com/Articles/Index.cfm?ArticleID=7899

Alternate logons are a fundamental change when managing an OS like W2K.
Consider as an example a regular user that runs a single MMC console with
elevated privileges to both manage a domain or server (while never exposing
the PC to the dangers involved). Only the application runs with the elevated
privileges.

<snip>
 
Back
Top