Best practices for workstation users who need Admin

[cnull]

I have a situation where most users need to have administrator privileges on their local PC. All PC's are on a domain so I made the assumption that I could just add DOMAIN\USERS to the administrator group of every PC. That was dumb because I just realized that now everyone has Admin to every PC on the network. For example everyone can just type \\hostname\c$ and get full access to every file on the PC, including the admins, managers etc... I need to fix this quickly. What is the best solution so that the users can remain a local admin and yet not have access to anyone else’s files?

Thanks!

 

[Spirit]

Remove the users group from the admin users and be more granualar.

Will the stores guy really need to log on to the MD's laptop? No.

But all stores guys will need admin rights to the stores PC so add the stores group to the pc then if you need to add others later.

Iain

 

[cnull]

Well grandular is good, but I was looking for something that is a little less work in the long run. For me it would be allot of work to maintain different groups in AD for each section. Our department is way too big.

I found another posible solution, Authenticated Users. I read this article about it and it seams that it might be the solution.

http://www.windowsitpro.com/Web/Article/ArticleID/23581/23581.html

Does anyone have any experience with Authenticated users group? How does it work for you? Will I run into any problems?

Thanks!

 

[58sniper]

RESTRICTED GROUPS will serve your need well.

However, I'd be more cautious about the need to have local admin rights in the first place.


Using Restricted Groups

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[cnull]

Yes, you are right. That looks like it might work. I also like that users cannot remove domain admins from the local admin group. We have some programmers that feel they are above the law and have done that. I feel much more powerfull now!!! LOL

Thanks! Good post 58sniper.

 

[markdmac]

I agree with Pat and would tell you that there is little reason for any user (even developers) to need to be admin on their box.

Setup security properly. Give them write rights to the program folders they need and change permissions to the registry keys/hives they need. That will supplement the need for admin rights in most situations.

This is often a lot of work the FIRST time as you work to get it right, but once you have the settings it is easy to maintain and set. For the NTFS permissions you can even create a script to set them up so it is just a double click operation.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript