How to globally add everyone to local administrators group???

[Todd Fuhrman]

How can I make a change through AD or Group Policy which will make all users
logging into any Windows 2000 Pro workstation a member of the local machines
administrator group?

Most users are already in the local Power Users group on the 2000
workstations. Will this cause a problem or will it add them to the
Administrator group and remove or ignore the fact that they are in the local
Power Users group?

Basically I have given up on trying to protect these people from themselves,
they are too impatient to wait a day until our department can install a
driver or device or application for them, I am going to give them what they
ask for, they have been made aware of the implications.

Thanks.

[Joe Rookie]

Not sure if you can do this through Group Policy ... I use a tool called
NetAdmin to this style change ... I can highlight all the workstations, and
make the change to all of them ... An alternative, from what it sounds like
your impatient users want (they should be made to wait two days, then, from
self-inflicted problems now <g>), you may want to configure the domain to
give the users the rights needed, instead of adding them to the
Administrators group ... Man, I just can't imagine the havoc they will
create if given Administrator rights ...

"Todd Fuhrman" <tfuh...@frsd.k12.nj.us> wrote in message
news:OgQXzFfbBHA.1792@tkmsftngp05...

[Daniel Lohmann]

Do you really want to give them Admin rights???? Sounds a bit
masochism to me, you are starting to run into real pain if they shoot
their machine once a week...

You may like to think about another option. I have written a tool
called NetExec (http://www.netexec.de/), which contains a so called
"CustomClient-Creator". This lets you create small .exe files, that
run a defined command line under another user account (like runas from
Win2k). The command line and password are stored encrypted inside the
.exe, so your users can run only *this* command line as Admin.

If they call you to install some software on their machine, you can
create an RunSetup.exe that runs the setup for this software as Admin.
(The setup.exe of the software itself should be located on a server
share, where it cannot be repaced with another program). You can then
send them the RunSetup.exe via e-mail or put it also on the server
share, where they would find it. Using this approach they can do the
install and don't have to wait for you, but you still have control
about what they do with their machines.

NetExec itself needs a service once to be installed on the client
machines, however it is possible to install this service remotely via
some simple batches.

Daniel

[Joe Richards [MVP]]

You can do this through group policies.

Pull all the workstations into an OU. Set up a policy on that OU with a
restricted group of administrators. Add in the default admin account name
(must be the same on all workstations) and add in the word Everyone. Do not
use the object pickers, type the names.

I don't recommend it but I won't try to protect you from yourself. ;p

--
Joe Richards
www.joeware.net
---

"Todd Fuhrman" <tfuh...@frsd.k12.nj.us> wrote in message
news:OgQXzFfbBHA.1792@tkmsftngp05...

[Roger Abell]

Yes, or try adding INTERACTIVE instead of Everyone
which will limit who is an Administrator to who can log
on locally to the specific machine.
I also do not recommend this, but if this is what you have
decided upon . . .
--
Roger Abell
PS. make sure you keep Domain Administrators in the
Restricted group definition for Administrators.

"Joe Richards [MVP]" <humore...@hotmail.com> wrote in message
news:Oz35$L7bBHA.1972@tkmsftngp04...

[Joe Richards [MVP]]

Woo Interactive does step up the security a bit, good idea.

--
Joe Richards
www.joeware.net
---

"Roger Abell" <ab...@asu.edu> wrote in message
news:unCmwW8bBHA.1404@tkmsftngp02...