Revoke local admin rights

  • Thread starter Thread starter Martin Horsley
  • Start date Start date
M

Martin Horsley

Hi all,

we have a situation where our client machines (100-ish) log on to their
machines with administrative rights (yeah, I know). After a spate of issues
with adware etc, I'd really like to revoke their privileges somewhat, either
by literally taking away install rights, or by finding a way to convert them
to ordinary non-admin accounts (pref. permanently). Is this possible, or am
I in for a long walk round the office? :o)

Cheers and thanks in advance, Martin H.

(e-mail address removed)
 
Martin,

Take a look at the Restricted Groups GPO. That might save you a few steps!

Cary
 
Ah thanks very much for the speedy response!

So (and I warn now, this is all new, and we will buy a book on it and do it
properly, just just right now we've got desktops covered in adverts and so
forth that are more pressing for the company than buying me training :o))
I'm in the GP editor on the PDC, in computer conf > Windows settings >
security settings > restricted groups? And what can I actually "do" in
there?
All the users are Domain Users, and so if they roam to a PC where there
account is not admin, then we have no problem. It's only when they're on
their 'home' machines where they have been set as admins that we have the
problem. I don't understand how I can make the Domain Users group be
restricted by some other group, when really that isn't what is giving them
Admin privileges anyway, it's the fact that they are admins on their local
machines.

Cheers, Martin H.
 
Not much!

You actually need to install the adminpak.msi on a WIN2000 workstation and
do the rest from there. Here are some links that I should have initially
included:

http://support.microsoft.com/?id=320065 ( you can change 'Administrators'
to any of the other groups, such as 'Power Users' if you need )


For additional information, take a look at these:

http://support.microsoft.com/?id=320045
http://support.microsoft.com/?id=279301
http://support.microsoft.com/?id=228496

And you might want to take a look at this:
http://support.microsoft.com/?id=810076

This is because according to 228496 whichever user or group accounts were a
member of 'Adminsitrators' - in your example - are kicked out / replaced by
the Restricted Group that you create. Think about Domain Admins....

HTH,

Cary
 
Back
Top