granting local admin rights

[darahw]

We have a growing IT department and we don't want everyone in the department to be a domain admin.

How do we just make a certain IT group a local admin on their machine without giving them domain admin control.

Mainly- we don't want these users to be able to login to a domain controller.

Please advise!!

 

[58sniper]

As has been discussed MANY times here lately:

Using Restricted Groups

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[darahw]

I am currently using GPO's restricted groups but it seems to be making users domain admins not just local admins.

I tried to search tek-tips to see if I could find my answer but I must not be searching on the right terms.

Built-in administrator- is that the local admin?

 

[58sniper]

Restricted Groups are for adding users to local groups on PCs, like the local admins group, or the Power Users group.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)