admin accounts

[tbalazs]

Domain server running 2K SP4 and workstations running XP Pro.

My question is this: Is there any way one workstation only can be locked down so that only the user has access (the guy with server admin permissions does not and can not change things such that he does)?

I imagine the answer to this is "no" but I have been asked to ask.

Another way of asking this might be: is it possible to prevent the admin from logging on to the domain as admin from this workstation only and preventing him from logging on as local admin as well, while permitting the usual user of the workstation (who could be given admin level privileges) to log on?

Or is it that ultimately, the sys admin can do anything?

Thanks.
Tony.

 

[ncotton]

you could create a gpo that blocks everything [not sure right now, (im at home, no box)] but you make the terminal useless. in AD create a sec group in each ou wherre the machine is located and the user is located, then aooke the gpo to the ou, and in the filter, add every user account, apart from your single user sec group and also add the single machine sec group/account.

so the lock down will apply to everyone not in your special group, but only on the one machine.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[Seaspray0]

goto the users and groups on the local pc, add the one user as a local admin and remove everyone else... including the domain admins group. edit the local security policy, specify that your one user has the right to log on locally.

sure the log on locally can be overwritten by a domain policy, but seldom is this policy ever specified for client pc's.

Start, Help. You'll be surprised what's there. A+/MCP/MCSE/MCDBA