Configure domain accounts to be local administrators

[Varun]

I'm a network admin but we are not a Microsoft shop (eDirectory). We have a stand alone network for internet access which we run ISA server on. Users log in to Active Directory on a Windows 2003 Server which runs ISA as well.

We don't really care about this network as far as what people do on thier workstations. I have googled this to no end, but since I am not a Microsoft Group Policy expert I am not sure how to create a Group Policy that would allow certain users to be local workstation admins but not domain admins. This would be for XP and Vista workstations.

Any help would be appreciated!

 

[MrChad]

Just add their domain accounts to their respective workstation(s)' local Administrators group.

 

[sonoma1993]

Originally posted by: Varun
I'm a network admin but we are not a Microsoft shop (eDirectory). We have a stand alone network for internet access which we run ISA server on. Users log in to Active Directory on a Windows 2003 Server which runs ISA as well.

We don't really care about this network as far as what people do on thier workstations. I have googled this to no end, but since I am not a Microsoft Group Policy expert I am not sure how to create a Group Policy that would allow certain users to be local workstation admins but not domain admins. This would be for XP and Vista workstations.

Any help would be appreciated!

not sure how do it with group policy, but on the local machines, on the xp and vista machines. If you go into computer management and to local user and groups. under groups. open up the local administrator group, and add either "domain usesr " group or a specific domain user name to the local administrator group. for this to work, you have to log on as the local administrator unless a domain admin or domain user was assign as an local admin when the workstation was joined to the domain.

 

[Varun]

Ah ok so this is something I have to do on the workstations. I was sure hoping I could do it with Group Policy since these machines are all over the place.

Thanks for the info though.

 

[sonoma1993]

Originally posted by: Varun
Ah ok so this is something I have to do on the workstations. I was sure hoping I could do it with Group Policy since these machines are all over the place.

Thanks for the info though.

you could use the microsoft management console. add the snap in for local user and groups. instead of selecting local computer, select the remote computer. once it connects, then you'll be able to manage the local user and groups for that remote computer.

 

[Varun]

Very cool I will give that a try!