Local administrator access group policy

[Dan L]

How would I go about pushing local administrator access to a domain
user account via group policy or whatever method is required to
perform such a task.

We basically implement users as power-users on the domain, but we want
them to have administrator access to the local machines.

Thanks in advance

Dan

[Chris Jones]

How many users/computers do you have, I think it would be easier to do it
manually.
"Dan L" <d...@cytex.net> wrote in message
news:3d625431.04033...@posting.google.com...

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.622 / Virus Database: 400 - Release Date: 3/13/2004

[Steve S]

It would also be much easier if you just made them domain admins, save your
self the trouble and make them a local power user, it's like you may trust
some employees enough to know all your business, but do you really want to
give access to your bank account whenever they like or keys to the front
door. With proper admin it's just not needed, it's the lazy way out.

"Chris Jones" <cka...@alltel.net> wrote in message
news:ulUmbgp...@tk2msftngp13.phx.gbl...

[Dan L]

I don't quite understand what your saying. Are you saying make them a
domain admin and a power user? I'm making them a power user on the
domain so they don't have access to modify certain things.

[Jim Behning SBS MVP]

If you are sitting at the server and you make a person a power user
you are makng them a power user on your server. They can do all kinds
of things folder and user related on the server. You want them to be
an administrator or power user on the workstation which is set from
the workstation. At least that is the way I do it. I have seen all
kinds of security problems when you start making users power users and
administrator on the server. Private folders are no longer private
because power users are in the group folder operators. power user on
the domain is too much power!!!!!!!

d...@cytex.net (Dan L) wrote:

Jim B. SBS MVP
remove the mvp to send email

[Dan L]

Hey Jim,

You are correct, I realized that yesterday at one of my clients. I
took everyone down to regular "users", I want to make them local
administrators on each workstation though without going through the
procedure of doing it manually.

[Renee Geffre [ MSFT]]

Hi Dan:

Thank you for contacting Microsoft Newsgroup Support. As I understand it,
you want to give each user Local Administrator rights on their workstations
using Group Policy, pushed from the server. Using group policy to do this
can be complicated and can only work with groups so you would end up with
all the domain users have local administrator rights on all the
workstations. What you can do is create a script that uses the Net group
command with a variable for the user name to add them to the local
Administrators account. The command would be:

net localgroup administrators %usersdomain%\%username% /add

This will take the currently logged on user and add them to the Local
Administrators group on the workstation. You can run the script at logon.
The following is an article that describes how to assign logon scripts.

322241 HOW TO: Assign Scripts in Windows 2000
http://support.microsoft.com/?id=322241

Best Regards,

Renee Geffre, Windows 2000 MCSE, MCSA
Microsoft Online Support Engineer

Get Secure! - www.microsoft.com/security

========================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

========================================================
This posting is provided "As Is" with no warranties, and confers no rights.